Operations management apparatus, operations management system, data processing method, and operations management program

ABSTRACT

An operations management apparatus which acquires performance information for each of a plurality of performance items from a plurality of controlled units and manages operation of the controlled units includes 
     a correlation model generation unit which derives a correlation function between a first element and a second element of the performance information, generates a correlation model between the first element and the second element based on the correlation function, and obtains the correlation model for each element pair of the performance information, and 
     a model searching unit which searches for the correlation model for each element between an input element and an output element among elements of the performance information in series, and predicts a value of the output element from a value of the input element based on the searched correlation model.

This application is based upon and claims the benefit of priority fromJapanese patent application No. 2008-043047, filed on Feb. 25, 2008, thedisclosure of which is incorporated herein in its entirety by reference.

TECHNICAL FILED

The present invention relates to an operations management apparatus, anoperations management system, a data processing method and an operationsmanagement program, and in particular, relates to an operationsmanagement apparatus which analyzes a bottleneck of the performance ofan entire system which provides an information and communicationsservice.

BACKGROUND ART

In relatively large scale systems such as a business information systemand an IDC (Internet Data Center) system, as the importance of aninformation and communications service such as a web service and abusiness service as a social infrastructure rises, stable operation ofan apparatus (e.g. a server) providing such services is important.Operations management of such an apparatus has been performed by anadministrator manually. As an apparatus becomes more complicated andlarge-scaled, burden on an administrator associated with knowledge andoperation increases by leaps and bounds, causing a situation such asservice suspension triggered by an error in judgment and by an operationmistake.

In order to handle such a situation, an integrated operations managementsystem which monitors and controls hardware or software included in asystem unitarily is provided.

This integrated operations management system acquires information aboutan operation status of a plurality of hardware or of software which isan administration object on-line, and outputs it to a display apparatuswhich is connected to the integrated operations management system. Amethod to distinguish a failure of a system being an administrationobject includes a method to set a threshold value to performanceinformation in advance and a method to evaluate a difference from a meanvalue. When it is determined that there is a failure, the location ofthe failure is reported.

When the location of the failure has been reported, narrowing down itscause such as whether it is caused by a lack of a memory capacity, anexcessive CPU load, an excessive network load or the like is needed fora failure solution. Because clarification of the cause generallyrequires an examination of system log or a parameter of a computer whichmight be related to the failure as well as system engineer's experienceand sense, time and energy is needed.

For this reason, in an integrated operations management system, it isimportant to perform handling support by performing an analysis of suchas combination of an abnormal states automatically based on event data(state notification) collected from a plurality of equipment, and bypresuming a problem and a cause broadly to notify an administrator.

In particular, in order to ensure reliability during long term continualpractical use of a service, it is required to detect not onlyabnormality which has occurred but also a state such as of performancedeterioration which is not showing clear abnormality currently or of asign of a failure expected to occur in the future, and to performdeliberate equipment reinforcement. As a response to such a request, inan integrated operations management system, it is important to analyze abottleneck of the performance in the entire system.

A technology in relation to such an integrated operations managementsystem includes the followings, for example.

An operations management apparatus in Japanese Patent ApplicationLaid-Open No. 2003-131907 performs performance monitoring in the stateof an assumed high load by performing a test which generates input to asystem falsely, and identifies an element which will be a bottleneck.This operations management apparatus can analyze behavior of the systemwhen the same load as of the time of the test occurs.

An operations management apparatus in Japanese Patent ApplicationLaid-Open No. 2006-024017 identifies an amount of a load caused byspecific processing by comparing the history of the processing of asystem element and the history of a change in performance information,and analyzes a load for an amount of the processing in the future. Thisoperations management apparatus can identify behavior of a system when arelation between processing and a load can be figured out in advance.

An operations management apparatus in Japanese Patent ApplicationLaid-Open No. 2002-268922 performs curve approximation of time seriesvariation of individual performance information from the history of thecollected performance information and predicts a value in the future.This operations management apparatus derives a situation which can occurfrom the present performance change as a hypothesis and enumeratescandidate elements which can be a bottleneck.

An operations management apparatus in Japanese Patent ApplicationLaid-Open No. 2002-342182 identifies a component which is a cause of afailure by quantifying a magnitude of relation between components of asystem based on operation information. This operations managementapparatus enumerates candidates of the cause for an element which hasbecome abnormal by weighting and displaying elements with correlation toa performance value as of that moment as a list.

In an operations management apparatus in Japanese Patent ApplicationLaid-Open No. 2006-146668, an operation information collection unitacquires hardware operation information of such as a CPU, a Network IO(network Input/Output) and the like and application operationinformation of such as access volume of a Web server and a processingquery amount of a DB server from a plurality of apparatus in a systemwhich is the target of monitoring at regular time intervals using ICMP,SNMP and rsh, and stores it in operation information DB. Apre-processing unit performs statistical processing which obtains astatistical analytical value between operation information on eachconstituent element stored in operation information DB. Thepre-processing unit finds a statistical analytical value by obtainingthe coefficient of correlation between individual operation informationor by performing main component analysis between individual operationinformation, for example. This statistical analytical value indicatesthe degree of association between operation information on eachapparatus in a given time. For example, in FIG. 2 of Japanese PatentApplication Laid-Open No. 2006-146668, the coefficient of correlation ofthe CPU utilization rate of server 1 and the CPU utilization rate ofserver 2 is 0.93. A coefficient of correlation represents the degree ofthe correlation between two variables. First, this operations managementapparatus periodically acquires hardware operation information such as aCPU utilization rate from a server and a network device and the likewhich are monitoring targets and, in the case of a Web server,application level information such as access situations, and thencalculates “the relation between acquired values” which characterizeseach situation using a statistical method such as a correlative analysisand main component analysis from operation information in each situationsuch as of the time of normal access and of the time of a failure, anddefines a model of each situation and hold it in model information DB.Next, at the time of operation, calculation is performed for the currentoperation information using the same statistical method as the modelswhich have been defined periodically or occasionally triggered by analert of a failure or by a decline of response of a provided service,and the result thereof is compared with the defined models stored inmodel information DB to identify the situation of a corresponding modelas the situation at present.

In an operations management apparatus in Japanese Patent ApplicationLaid-Open No. 2007-207117, a monitor unit acquires status informationrelated to a state of AC environment and non-AC environment. An analysisunit or a model diagnosis unit judges a state of an apparatus in ACenvironment based on acquired status information. A simulation unitrefers to a countermeasure list corresponding to the judgment result,carries out simulation processing by a countermeasure included in thecountermeasure list and evaluates the effect of the each countermeasure.A model extraction unit plots monitoring data of at times 1-3 in acoordinate system representing relation of the usage rate of a CPU totime, and extracts a model which expresses a time series change of theCPU usage rate by obtaining a linear approximation equation (fa(x)=αx+β)for each monitoring data plotted. A model extraction unit accumulatesthe extracted model in a knowledge information accumulation unit.Similarly, the model extraction unit obtains a model also in acoordinate system representing relation of the throughput to time. Themodel extraction unit obtains linear approximation equations(fTA(x)=ρ1x+θ1 and fTB(x)=ρ2x+θ2) representing correlation between theCPU utilization rate and the throughput for each of processing A andprocessing B using a correlative analysis and a multivariate analysis tothese two models, and extracts a model which indicates a correlationbetween the CPU utilization rate and the throughput. A model diagnosisunit refers to a policy corresponding to each model respectively andperforms diagnosis (see paragraph numbers 0060-0062 of Japanese PatentApplication Laid-Open No. 2007-207117).

In Published Japanese translation of PCT application No. 2005-524886bulletin, a collector is started based on a type of a workload duringoperation on the computer, and a threshold value for a metrics is setbased on the workload. Next, it is determined when the metrics exceedsthe threshold value (according to both of the present workload and anpredicted workload), and a correlation between each metrics is obtainedto judge whether the hardware capacity is the cause of the problem.

SUMMARY

An exemplary object of the invention is to provide an operationsmanagement apparatus, an operations management system, a data processingmethod and an operations management program capable of a bottleneckanalysis in which administrator's burden is low and which does notincrease the processing load that is also needed for an analysis in thelarge-scale environment, while enabling to predict a bottleneck whichmay occur in an actual operational situation correctly.

An operations management apparatus which acquires performanceinformation for each of a plurality of performance items from aplurality of controlled units and manages operation of the controlledunits according to an exemplary aspect of the invention includes acorrelation model generation unit which derives, when the performanceitems or the controlled units are designated as an element ofperformance information, a correlation function between a first seriesof performance information that indicates time series variation about afirst element and a second series of performance information thatindicates time series variation about a second element, generates acorrelation model between the first element and the second element basedon the correlation function, and obtains the correlation model for eachelement pair of the performance information, and a model searching unitwhich searches for the correlation model for each element between aninput element and an output element among elements of the performanceinformation in series, and predicts a value of the output element from avalue of the input element based on the searched correlation model.

An operations management system according to an exemplary aspect of theinvention includes a plurality of controlled units, an operationsmanagement apparatus which acquires performance information for each ofa plurality of performance items from the controlled units and managesoperation of the controlled units, wherein the operations managementapparatus including a correlation model generation unit which derives,when the performance items or the controlled units are designated as anelement of performance information, a correlation function between afirst series of performance information that indicates time seriesvariation about a first element and a second series of performanceinformation that indicates time series variation about a second element,generates a correlation model between the first element and the secondelement based on the correlation function, and obtains the correlationmodel for each element pair of the performance information, and a modelsearching unit which searches for the correlation model for each elementbetween an input element and an output element among elements of theperformance information in series, and predicts a value of the outputelement from a value of the input element based on the searchedcorrelation model.

A data processing method of an operations management apparatus whichacquires performance information for each of a plurality of performanceitems from a plurality of controlled units and manages operation of thecontrolled units according to an exemplary aspect of the inventionincludes obtaining a correlation model for each element pair of theperformance information by deriving, when the performance items or thecontrolled units are designated as an element of the performanceinformation, a correlation function between a first series ofperformance information that indicates time series variation about afirst element and a second series of the performance information thatindicates time series variation about a second element and by generatingthe correlation model between the first element and the second elementbased on the correlation function, and predicting, by searching for thecorrelation model for each element between an input element and anoutput element among elements of the performance information in series,a value of the output element from a value of the input element based onthe searched correlation model.

A computer readable medium embodying a program, the program causing anoperations management apparatus which acquires performance informationfor each of a plurality of performance items from a plurality ofcontrolled units and manages operation of the controlled units toperform a method, according to an exemplary aspect of the inventionincludes obtaining a correlation model for each element pair of theperformance information by deriving, when the performance items or thecontrolled units are designated as an element of the performanceinformation, a correlation function between a first series ofperformance information that indicates time series variation about afirst element and a second series of the performance information thatindicates time series variation about a second element and by generatingthe correlation model between the first element and the second elementbased on the correlation function, and predicting, by searching for thecorrelation model for each element between an input element and anoutput element among elements of the performance information in series,a value of the output element from a value of the input element based onthe searched correlation model.

An operations management apparatus which acquires performanceinformation for each of a plurality of performance items from aplurality of controlled units and manages operation of the controlledunits according to an exemplary aspect of the invention includes acorrelation model generation means for obtaining a correlation model foreach element pair of the performance information by deriving, when theperformance items or the controlled units are designated as an elementof the performance information, a correlation function between a firstseries of performance information that indicates time series variationabout a first element and a second series of the performance informationthat indicates time series variation about a second element and bygenerating the correlation model between the first element and thesecond element based on the correlation function, and a model searchingmeans for predicting, by searching for the correlation model for eachelement between an input element and an output element among elements ofthe performance information in series, a value of the output elementfrom a value of the input element based on the searched correlationmodel.

A data processing method of an operations management apparatus whichacquires performance information for each of a plurality of performanceitems from a plurality of controlled units and manages operation of thecontrolled units according to an exemplary aspect of the inventionincludes a step for obtaining a correlation model for each element pairof the performance information by deriving, when the performance itemsor the controlled units are designated as an element of the performanceinformation, a correlation function between a first series ofperformance information that indicates time series variation about afirst element and a second series of the performance information thatindicates time series variation about a second element and by generatingthe correlation model between the first element and the second elementbased on the correlation function and a step for predicting, bysearching for the correlation model for each element between an inputelement and an output element among elements of the performanceinformation in series, a value of the output element from a value of theinput element based on the searched correlation model.

BRIEF DESCRIPTION OF THE DRAWINGS

Exemplary features and advantages of the present invention will becomeapparent from the following detailed description when taken with theaccompanying drawings in which:

FIG. 1 is an exemplary block diagram of the entire structure of theoperations management system including an operations managementapparatus of a first exemplary embodiment.

FIG. 2 is an exemplary block diagram of a configuration which is thepremise of the operations management apparatus of the first exemplaryembodiment.

FIG. 3 is an exemplary diagram of performance information used by anoperations management apparatus of the first exemplary embodiment.

FIG. 4 is an exemplary diagram of a graph of time series variation ofperformance information used by an operations management apparatus ofthe first exemplary embodiment.

FIG. 5 is an exemplary block diagram of the entire structure of theoperations management apparatus of the first exemplary embodiment.

FIG. 6 is another exemplary block diagram of the entire structure of theoperations management apparatus of the first exemplary embodiment.

FIG. 7 is an exemplary diagram of transform function identification inan operations management apparatus of the first exemplary embodiment.

FIG. 8 is an exemplary diagram of a data structure of a correlationmodel in an operations management apparatus of the first exemplaryembodiment.

FIG. 9 is an exemplary diagram of weight comparison in an operationsmanagement apparatus of the first exemplary embodiment.

FIG. 10 is an exemplary diagram of a data structure of resourceinformation in an operations management apparatus of the first exemplaryembodiment.

FIG. 11 is an exemplary flowchart of the overall processing procedure inan operations management apparatus of the first exemplary embodiment.

FIG. 12 is an exemplary flowchart of a detailed processing procedure ofcorrelation model generation in an operations management apparatus ofthe first exemplary embodiment.

FIG. 13 is an exemplary flowchart of a detailed processing procedure ofmodel search in an operations management apparatus of the firstexemplary embodiment.

FIG. 14 is an exemplary flowchart of a detailed processing procedure ofa bottleneck analysis in an operations management apparatus of the firstexemplary embodiment.

FIG. 15 is an exemplary diagram of an indicated display screen in anoperations management apparatus of the first exemplary embodiment.

FIG. 16 is an exemplary block diagram of the entire structure of anoperations management apparatus of a second exemplary embodiment.

FIG. 17 is another exemplary block diagram of the entire structure of anoperations management apparatus of the second exemplary embodiment.

FIG. 18 is an exemplary diagram of total performance informationgeneration in an operations management apparatus of the second exemplaryembodiment.

FIG. 19 is an exemplary diagram of a data structure of resourceinformation in an operations management apparatus of the secondexemplary embodiment.

FIG. 20 is an exemplary flowchart of a detailed processing procedure ofcorrelation model generation in an operations management apparatus ofthe second exemplary embodiment.

FIG. 21 is an exemplary flowchart of a detailed processing procedure ofmodel search in an operations management apparatus of the secondexemplary embodiment.

FIG. 22 is an exemplary block diagram of the entire structure of anoperations management apparatus of a third exemplary embodiment.

FIG. 23 is another exemplary block diagram of the entire structure of anoperations management apparatus of the third exemplary embodiment.

FIG. 24 is an exemplary flowchart of a detailed processing procedure ofanalysis setting generation in an operations management apparatus of thethird exemplary embodiment.

FIG. 25 is an exemplary diagram of an indicated display screen in anoperations management apparatus of the third exemplary embodiment.

FIG. 26 is another exemplary diagram of an indicated display screen inan operations management apparatus of the third exemplary embodiment.

EXEMPLARY EMBODIMENT

[Basic Configuration of Operations Management Apparatus]

First, a basic configuration of an operations management apparatus willbe described. An operations management apparatus (shown by symbol “100”in FIG. 5, for example) of the present exemplary embodiment acquiresperformance information for each of a plurality of performance itemsfrom a plurality of controlled units of a system and manages theoperation of the controlled units.

This operations management apparatus includes: a correlation modelgeneration unit (shown by symbol “123” in FIG. 5, for example) whichderives, when the performance items or the controlled units aredesignated as an element of performance information, a correlationfunction between a first series of performance information thatindicates time series variation about a first element and a secondseries of performance information that indicates time series variationabout a second element, generates a correlation model between the firstelement and the second element based on the correlation function, andobtains the correlation model for each element pair of the performanceinformation; and a model searching unit (shown by symbol “124” in FIG.5, for example) which searches for the correlation model for eachelement between an input element and an output element among elements ofthe performance information successively, and predicts a value of theoutput element from a value of the input element based on the searchedcorrelation model.

The operations management apparatus may further includes: a bottleneckanalysis unit which generates, based on resource information whichspecifies a range of a value of an element of the performanceinformation, when a predicted value of the output element predicted bythe model searching unit exceeds the range, a bottleneck analysis resultincluding the output element and the value of the output element (shownby symbol “125” in FIG. 5, for example).

In this operations management apparatus, the correlation modelgeneration unit generates a correlation model of the overall operatingstates of the service executor as a transform function between elementsof performance information. When a value of one element (input element)of performance information is assumed, a value of another element(output element) is predicted by the model searching unit by tracing thetransform functions in this correlation model in sequence.

Bottleneck analysis unit receives, while increasing and decreasing thevalue of the one element (input element) in sequence, a value of anotherelement (output element) predicted by the model searching unit and whena predicted value of the element (output element) exceeds a limit,generates an analysis result including the output element and the valueof the input element as of that moment.

Thus, this operations management apparatus can analyze a bottleneck inconformity with a situation at the time of operation includingsituations failed to have been assumed at the time of a test, bygenerating a correlation model of performance information automaticallyfrom detected performance information to perform a bottleneck analysis.

This operations management apparatus can analyze not only behaviorrelated to specific processing which is assumed in advance but alsowhole behavior of the service executor comprehensively.

Further, influence of performance information from other elements isreflected to the one element by a correlation model. Accordingly, theoperations management apparatus can figure out and extract an elementwhich will be a bottleneck in the future in the overall operationstatuses of a system by a correlation model between each element ofperformance information.

That is, verification of an analysis result does not need to be dependedon administrator's experience, because the operations managementapparatus can extract a bottleneck with a high possibility to occur inthe targeted system in the future based on a correlation betweenelements of performance information detected in actual practical use.

Also, a correlation model generated includes a transform function thatconverts between elements of performance information in 1 to 1.Accordingly, the operations management apparatus can derive otherelements from one element of performance information easily, and even ifa system is magnified, can analyze a bottleneck without the amount ofprocessing becoming enormous.

Thus, the present exemplary embodiment solves an issue of relatedtechnology by extracting and modeling a correlation between elements ofdetected performance information appropriately, and consequently canpredict a bottleneck which may occur in an actual operational situationcorrectly. The present exemplary embodiment enables a bottleneckanalysis in which administrator's burden is low and which does notincrease the processing load that is also needed for an analysis in thelarge-scale environment,

Hereinafter, exemplary embodiments in which such an operationsmanagement apparatus is applied to the operations management system willbe described.

[First Exemplary Embodiment]

(Entire Structure of Operations Management System)

First, regarding the concrete configuration of an operations managementsystem in a first exemplary embodiment, the entire structure isdescribed, followed by a description of a detailed structure of eachpart.

FIG. 1 is an exemplary block diagram of the entire structure of anoperations management system including an operations managementapparatus of the first exemplary embodiment.

As shown in FIG. 1, operations management system 1 in the firstexemplary embodiment includes computers 2 which are a plurality ofcontrolled units, operations management apparatus 3 which is capable ofcommunicating with computers 2 via network N, and manages the operationof computers 2.

Operations management apparatus 3 acquires performance information foreach of a plurality of performance items (a CPU utilization factor andremaining memory capacity, for example) from the plurality of computers2.

Computer 2 and operations management apparatus 3 may be any computer ifit is operated by program control and includes a network relatedfunction, such as a desktop computer, a laptop computer, a server, orsome other information devices having wireless or wired communicationfunctions or a computer similar to this. Computer 2 and operationsmanagement apparatus 3 may be of a portable type or a stationary type.

The hardware configuration of operations management apparatus 3 includesa display unit (screen) indicating various information or the like, anoperation input unit (such as a keyboard and a mouse, for example)performing operational input of data on the display screen of thedisplay unit (such as on various input columns), a transmission andreception unit (a communication unit) sending and receiving varioussignals and data, a memory unit (such as a memory and a hard disk, forexample) storing various programs and various data, a control unit (suchas CPU, for example) which controls these units, and the like.

Computer 2 also may be a network device or other equipment, or amainframe.

(Premised Configuration)

Here, the configuration of an operations management apparatus which is apremise of the first exemplary embodiment will be described referring toFIG. 2, FIG. 3 and FIG. 4 before describing the characteristicconfiguration of the first exemplary embodiment.

FIG. 2 is an exemplary block diagram of a configuration which is thepremise of an operations management apparatus of the first exemplaryembodiment. Referring to FIG. 2, operations management apparatus 3 whichindicates the configuration which is the premise of the first exemplaryembodiment includes service executor 21, performance information storageprocessing unit 12, information collection unit 22, analysis settingstorage processing unit 14, failure analysis unit 26, administratordialogue unit 27 and handling executing unit 28.

Service executor 21 provides an information and communications servicesuch as a web service and a business service. Service executor 21 may beon another independent computer or the like.

Performance information storage processing unit 12 accumulates eachelement of performance information of service executor 21.

Information collection unit 22 detects an operation state of serviceexecutor 21 and accumulates in performance information storageprocessing unit 12 performance information included in the operationstate.

Analysis setting storage processing unit 14 accumulates an analysissetting to detect abnormality of service executor 21.

Failure analysis unit 26 receives an operation state from informationcollection unit 22 and performs failure analysis according to theanalysis setting of analysis setting storage processing unit 14.

Administrator dialogue unit 27 receives a result of the failure analysisfrom failure analysis unit 26 and presents it to an administrator.Administrator dialogue unit 27 accepts administrator's input andinstructs handling executing unit 28 to handle a failure according toadministrator's input.

Handling executing unit 28 carries out processing which is handling forthe failure on service executor 21 according to the instruction ofadministrator dialogue unit 27.

FIG. 3 is an exemplary diagram of performance information used by anoperations management apparatus of the first exemplary embodiment. FIG.3 shows performance information outputted by information collection unit22 and accumulated in performance information storage processing unit12. Each line of performance information 12 a includes values for eachperformance item (element) at the same point of time, and the values arelisted at regular time intervals.

FIG. 4 is an exemplary diagram of a graph of time series variation ofperformance information used by an operations management apparatus ofthe first exemplary embodiment. FIG. 4 indicates time series variationof one element included in the performance information. Graph G101indicates time series variation of SV1-CPU included in performanceinformation 12 a shown in FIG. 3. Graph G201 is an example of linearprediction of time series variation of graph G101.

Operation of operations management apparatus 3 having the premisedconfiguration mentioned above will be described using FIG. 2, FIG. 3 andFIG. 4.

First, information collection unit 22 of FIG. 2 detects an operationstate of service executor 21 and accumulates performance information inperformance information storage processing unit 12. For example, when aweb service is carried out by service executor 21, informationcollection unit 22 detects CPU utilization rate and remaining memorycapacity of each server which provides the web service at regular timeintervals.

Performance information 12 a of FIG. 3 is an example of the detectedperformance information. For example, SV1-CPU indicates a value of a CPUutilization factor of one server, and the value at time 17:25 of Oct. 5,2007 is 12. The values of 15, 34 and are detected at one minuteintervals from 17:26. Similarly, SV1-MEM is the value of the remainingmemory capacity of the same server and SV2-CPU is the value of the CPUutilization factor of a different server detected at the same time ofday.

Next, failure analysis unit 26 performs a failure analysis according toa analysis setting accumulated in analysis setting storage processingunit 14. As an analysis setting, a detection condition of a failure isdesignated such as when the CPU utilization factor exceeds a certainvalue, a warning message is presented to an administrator, for example.Failure analysis unit 26 determines whether a load of a specific serverhas become high or not from the value of the performance informationdetected by information collection unit 22 using a threshold valueaccording to an analysis setting.

Administrator dialogue unit 27 presents a result of such failureanalysis to an administrator. When an administrator performs an inputoperation which directs administrator dialogue unit 27 to perform somehandling for the result of the failure analysis, administrator dialogueunit 27 carries out a handling command on service executor 21 viahandling executing unit 28.

For example, when knowing that a CPU load has become high, theadministrator reduces the amount of services or performs a configurationchange for load sharing.

When a value of the performance information collected by informationcollection unit 22 at regular time intervals decreases after this,failure analysis unit 26 determines that the failure has been recoveredand shows the result to the administrator via administrator dialogueunit 27. By a repeat of processing of such an information collection,analysis and handling, failure handling for service executor continuesto be performed.

Here, in an operations management apparatus in Japanese PatentApplication Laid-Open No. 2003-131907, a function corresponding toservice executor 21 of operations management apparatus 3 carries outprocessing which is expected to cause an assumed heavy load state. Thisprocessing is such as generating access from a large number of clientsof a web service falsely. In this state, through collection ofperformance information from a function corresponding to serviceexecutor 21 by a function corresponding to information collection unit22 of operations management apparatus 3 and analysis by a functioncorresponding to failure analysis unit 26, an administrator can learnwhich element of the system will become abnormal in the assumed heavyload state.

For example, when a load as shown in graph G101 of FIG. 4 is obtainedand its peak value exceeds a threshold value and reaches a criticalregion which is found in advance, an administrator can find theprocessing power of SV1 will be lacking. Conversely, when all of theperformance information is within a threshold value, the administratorcan learn the system is safe for the assumed load.

In this Japanese Patent Application Laid-Open No. 2003-131907,performance information on a system in a case of an assumed heavy loadstate can be analyzed correctly. However, not all heavy load stateswhich have a possibility of occurring in the future in a system can betested beforehand. For example, by a test which generates access foundwhen clients use a service averagely, fault tolerance in average use canbe secured. However, it is difficult to test access leaning to aspecific service according to changes in user's taste and socialsituation. Accordingly, when use of a system is prolonged, an unexpectedelement will be a bottleneck by unexpected use. Consequently, failuresoccur by this bottleneck.

In an operations management apparatus in Japanese Patent ApplicationLaid-Open No. 2006-024017, such analysis is performed more in detail. Inan operations management apparatus in Japanese Patent ApplicationLaid-Open No. 2006-024017, a function corresponding to informationcollection unit 22 of operations management apparatus 3 collects thehistory of processing which has been performed in a functioncorresponding to service executor 21 of operations management apparatus3 in addition to performance information, and a function correspondingto failure analysis unit 26 of operations management apparatus 3analyzes the performance information and the processing history alltogether.

For example, by collecting the detailed execution history of processingfor which a relation with a CPU load is known in advance, a CPUutilization factor can be predicted from timing that the processing isperformed. That is, when knowing by which processing the peak value ingraph G101 of FIG. 4 is caused, a future load of SV1-CPU can bepredicted from timing that the processing is carried out.

In this Japanese Patent Application Laid-Open No. 2006-024017, adetailed failure analysis can be performed for processing for whichcausal relation with performance information is made clear in advance.However, when causality becomes complicated as well as the processingload is increased in order to perform additional collection of thehistory of the processing, it will be difficult for an administrator tounderstand a result of analysis.

In particular, in recent years, the importance of an IT system as asocial infrastructure has been increasing, and scale of a system hasbecome large and it often cooperates with other systems. In such asituation, advanced knowledge to analyze complicated causality is neededfor an administrator, because an enormous processing history iscollected.

In an operations management apparatus in Japanese Patent ApplicationLaid-Open No. 2002-268922, a load is predicted from time seriesvariation of performance information, not from the relation withprocessing. In an operations management apparatus in Japanese PatentApplication Laid-Open No. 2002-268922, a function corresponding tofailure analysis unit 26 of operations management apparatus 3 analyzesthe tendency of time series variation of detected performanceinformation and predicts a change in the performance information in thefuture.

For example, the operations management apparatus derives that a value ofSV1-CPU has a tendency of monotonic increase as shown in graph G201 fromtime series variation as shown in graph G101 of FIG. 4. The operationsmanagement apparatus predicts time when a CPU load will reach to acritical region from an increased percentage of SV1-CPU. By predictingtime when other elements reach a critical region similarly, theoperations management apparatus can find out an element expected toreach a critical region earliest in the entire system.

In this Japanese Patent Application Laid-Open No. 2002-268922, apossibility of each element of performance information to be abottleneck in the future can be shown to an administrator. However, theadministrator has to judge from his/her experience whether thesebottlenecks can occur actually.

For example, when remaining memory capacity is below a predeterminedvalue, if a recovery of the memory capacity is waited for withoutbeginning of new processing, whether monotonous increase will be alsoobserved in a CPU load in the future like the tendency of a certain timepoint is not clear unless a change in remaining memory capacity is takeninto account.

In order to judge the validity of a result of the tendency prediction,an administrator has to understand a correlation between elements whichexist in a system correctly.

In an operations management apparatus in Japanese Patent ApplicationLaid-Open No. 2002-342182, a correlation between elements of a system isanalyzed. In an operations management apparatus in Japanese PatentApplication Laid-Open No. 2002-342182, when a function corresponding tofailure analysis unit 26 of operations management apparatus 3 findsabnormality of performance information on a system element, a list ofcomponents having a correlation with the value of the performanceinformation at that time is generated from performance informationreceived from information collection unit 22, and it is shown to anadministrator by a function corresponding to administrator dialogue unit27.

For example, when abnormality of SV1-CPU is found in performanceinformation 12 a of FIG. 3, the operations management apparatus performsmulti regression analysis of the values of SV1-MEM and SV2-CPU and thevalues of SV1-CPU, and enumerates elements regarded as having a highcorrelation.

As a result, the administrator can learn that the abnormality of SV1-CPUmay have been caused by SV1-MEM.

In this Japanese Patent Application Laid-Open No. 2002-342182, theoperations management apparatus can show a possibility of a certainabnormality and causality to an administrator. However, theadministrator has to perform verification whether that is right or not.The operations management apparatus also can show a correlation betweenthe values of the detected performance information to an administrator.However, the operations management apparatus cannot derive which elementwill be a bottleneck for a load with a possibility to occur in thefuture.

As stated above, in an actual operational situation, there is a problemthat an operations management apparatus of the related technology cannotpredict correctly a bottleneck which will occur, and burdens of anadministrator is large and the processing load of the informationcollection and the analysis is heavy.

Accordingly, in the first exemplary embodiment, there is acharacteristic configuration indicated below.

(Characteristic Composition of the First Exemplary Embodiment)

Here, the characteristic configuration of an operations managementapparatus of the first exemplary embodiment will be described withreference to FIG. 5. FIG. 5 is an exemplary block diagram of the entirestructure of an operations management apparatus of the first exemplaryembodiment.

As shown in FIG. 5, operations management apparatus 100 of the firstexemplary embodiment includes correlation model generation unit 123,correlation model information storage processing unit 116, modelsearching unit 124, resource information storage processing unit 118 andbottleneck analysis unit 125 as well as service executor 121,performance information storage processing unit 112, informationcollection unit 122, analysis setting storage processing unit 114,failure analysis unit 126, administrator dialogue unit 127 and handlingexecuting unit 128 which are the same configurations as operationsmanagement apparatus 3 shown in FIG. 2.

Correlation model generation unit 123 takes out performance informationfor a certain period from performance information storage processingunit 112, and derives, for time series of two discretionary elements ofthe performance information, a transform function when making oneelement as input and making the other as output. Then, correlation modelgeneration unit 123 compares a series of values of the element generatedby this transform function and a series of an actual detected value, andcalculates the weight of the transform function from the differencebetween those values. By repeating these processing for all elementpairs, correlation model generation unit 123 generates a correlationmodel of the overall operating state of service executor 121.

Correlation model information storage processing unit 116 accumulatesthe correlation model generated by correlation model generation unit123.

By tracing a transform function between each of the elements of thecorrelation model accumulated in correlation model information storageprocessing unit 116 in sequence, model searching unit 124 predicts thevalue of another element (output element) when a value of one element(input element) among the elements of performance information issupposed. When different values are predicted to one element by aplurality of transform functions, one value is selected based on theweight.

Resource information storage processing unit 118 accumulates resourceinformation which is information describing attributes such as themaximum value, the minimum value and the unit of a value for eachperformance item (element).

Bottleneck analysis unit 125 instructs model searching unit 124 toperform model search while increasing or decreasing successively a valueof one input element designated in advance among the elements of theperformance information. Bottleneck analysis unit 125 receives the valueof another element (output element) which model searching unit 124 haspredicted and compares it with the resource information accumulated inresource information storage processing unit 118. When the value of theoutput element predicted by model searching unit 124 exceeds the rangeindicated in the resource information, bottleneck analysis unit 125generates an analysis result including the output element and the valueof the input element at that time, and outputs the analysis result toadministrator dialogue unit 127.

FIG. 6 is another exemplary block diagram of the entire structure of theoperations management apparatus of the first exemplary embodiment. Asshown in FIG. 6, each unit of operations management apparatus 100 mayinclude a plurality of functions of a control unit.

When the above-mentioned performance items or controlled units aredesignated as an element of performance information, correlation modelgeneration unit 123 may derive a correlation function between a firstseries of performance information that indicates time series variationabout a first element and a second series of performance informationthat indicates time series variation about a second element, andgenerate a correlation model between the first element and the secondelement based on the correlation function, and obtains the correlationmodel for respective element pairs of the performance information.

Then, model searching unit 124 may search for the correlation model foreach element between an input element and an output element amongelements of the performance information in series, and predict a valueof the output element from a value of the input element based on thesearched correlation model.

Further, bottleneck analysis unit 125 may generate, based on resourceinformation which specifies a range of a value of an element of theperformance information, when a predicted value of the output elementpredicted by the model searching unit exceeds the range, a bottleneckanalysis result including the output element and the value of the outputelement.

Correlation model generation unit 123 calculates a weight of acorrelation model between each of the elements based on an error betweena value of a second element predicted from a value of the first elementusing the correlation function and a value of the second elementacquired. In this case, model searching unit 124 determines, whendifferent values can be predicted depending on a plurality ofcorrelation models for the output elements, a value of the outputelements based on the weight.

Correlation model generation unit 123 may calculate a first weight ofthe correlation model of the first element and the second element, asecond weight of the correlation model of the first element and a thirdelement and a third weight of the correlation model of the third elementand the second element, respectively. In this case, model searching unit124 compare an aggregated weight of the second weight and the thirdweight to the first weight, and predict a value of the output element.

Also, the bottleneck analysis unit 125 may include the element sequencedin order of a rate of utilization in the bottleneck analysis result.Bottleneck analysis unit 125 may include the input element and a valueof the input element at the moment when a value of the output elementexceeds the range in the bottleneck analysis result.

(Correlation Model Generation)

Here, the outline of correlation model generation by correlation modelgeneration unit 123 will be described with reference to FIG. 7. FIG. 7is an exemplary diagram of transform function identification in anoperations management apparatus of the first exemplary embodiment.

Generation of a correlation function can be performed by processing ofStep S103 (a correlation function generation function) shown in FIG. 12to generate a correlation function (transform function) and Step S104 (aweight calculation function) to calculate an error.

As shown in FIG. 7, transform function G300 takes a series of the valuesof SV1-CPU indicated in graph G101 (a first series of performanceinformation) as input, and outputs a series of the values of SV1-MEMindicated in graph G102 (a second series of performance information).

Correlation model generation unit 123 calculates this transform functionG300 by system identification processing G301.

For example, correlation model generation unit 123 calculates A=−0.6 andB=100 for a transform function indicated by a formula of y=Ax+B.

As indicated in graph G302, correlation model generation unit 123generates a weight w from a difference between the series of predictedvalues of an element of performance information generated from graphG101 using this transform function and a series of values of the elementof performance information detected actually as indicated in graph G102.

Here, weight w may be defined as value 0-1 representing the magnitude ofa difference (prediction error) between a series of values of an elementpredicted by this transform function and a series of values detectedactually, for example. In this case, the larger the difference(prediction error) is, the smaller weight w is, and the smaller thedifference (prediction error) is the larger weight w is. In this case,weight w may be a value corresponding to a percentage of a predictedvalue which is matched with a detected value, and it may be 1 when aseries of predicted values and a series of detected values are identicalcompletely, and when they are not identical at all. Alternatively,weight w may be a value which includes the degree of a difference when apredicted value is not identical with a detected value.

FIG. 8 is an exemplary diagram of a data structure of a correlationmodel in an operations management apparatus of the first exemplaryembodiment. Correlation model 116 a includes an element (a performanceitem) of performance information which is assigned as input of atransform function, an element (a performance item) of the performanceinformation which is assigned as output, a value of each coefficientthat specifies a transform function and a weight. For example, when thetransform function is y=Ax+B as shown in FIG. 7, the value −0.6 of thecoefficient A, the value 100 of the coefficient B and the weight 0.88are accumulated for SV1-CPU and SV1-MEM.

(Model Search)

Next, the outline of model search by model searching unit 124 will bedescribed with reference to FIG. 9. FIG. 9 is an exemplary diagram ofweight comparison in an operations management apparatus of the firstexemplary embodiment.

Model search using a weight is performed at Step S206 shown in FIG. 13for selecting a value of an element of performance information.

In correlation graph G310 of FIG. 9, as transform functions betweenelement x, y and z, there are y=2x, z=2y, z=3.9x. A weight w of therespective transform functions is 0.7, 0.9 and 0.8. When a value of z iscalculated, model searching unit 124 compares the weight 0.63 of theroute x->y->z and the weight 0.8 of the route x->z. Model searching unit124 selects the route x->z which has a larger value. As a result, incase of x=10, model searching unit 124 calculates the value 39 of z byapplying the formula of z=3.9×.

(Bottleneck Analysis)

In a bottleneck analysis by bottleneck analysis unit 125, determinationof whether performance information predicted by model searching unit 124based on resource information exceeds a limit or not is made.

FIG. 10 is an exemplary diagram of a data structure of resourceinformation in an operations management apparatus of the first exemplaryembodiment. Resource information 118 a includes the name (a performanceitem) of an element of performance information of a system, the unit,the minimum and the maximum of a value.

Bottleneck analysis unit 125 may indicate an analysis result on adisplay unit.

FIG. 15 is an exemplary diagram of a display screen in an operationsmanagement apparatus of the first exemplary embodiment. In FIG. 15, adisplay screen in a bottleneck analysis is indicated. As a result of thebottleneck analysis, display screen U100 shows that a value of outputelement SV2-CPU exceeds a limit value when the input element to a systemamong elements of performance information is the value 600/sec. Displayscreen U100 displays a list of the elements at that time in descendingorder of the utilization rate. Moreover, display screen U100 indicates agraph showing a relation between the value of the input element to thesystem and element SV2-CPU selected on the displayed list. This graphindicates predicted values of output element SV2-CPU and points whichindicate detected values of element SV2-CPU versus the input element tothe system.

Display screen U100 (a bottleneck analysis screen) shown on the displayunit includes analysis result display portion U110 which indicates abottleneck analysis result. Analysis result display portion U110 mayindicate an element (an abbreviation character or symbol that identifiesa performance item and a device name) with the highest rate ofutilization, a rate of utilization of the element and a value of theinput element and the like.

Display screen U100 further includes element list display portion U120which lists elements in order of a rate of utilization from highest tolowest. Element list display portion U120 may indicate an element ofperformance information (a performance item), a rate of utilization ofthe element, and other information and the like.

Display screen U100 also includes graph display portion U130 thatindicates a graph about an element selected on the element list ofelement list display portion U120. Graph display portion U130 mayindicate a predicted value of an element calculated using the transformfunction, points which indicate detected values of the element and aline of 100%.

Display screen U100 further includes first display operation portionU142 indicating detailed information on a correlation model, seconddisplay operation portion U144 indicating detailed information onresource information and third display operation portion U146terminating displaying the bottleneck analysis screen.

By using such a user interface, an administrator can correctly analyzewhere a bottleneck is.

(Processing Procedure)

(The Overall Processing Procedure)

Next, processing of each unit in an operations management apparatusincluding the above-mentioned configurations may be also realized as amethod, and thus various processing procedures will be described as adata processing method with reference to FIGS. 11-14.

FIG. 11 is an exemplary flowchart of the overall processing procedure ofan operations management apparatus of the first exemplary embodiment.

A data processing method according to the first exemplary embodimentperforms information processing which manages the operation of aplurality of controlled units based on performance information for eachof a plurality of performance items from the plurality of controlledunits of a system.

When the performance items or the controlled units mentioned above aredesignated as elements of performance information, this data processingmethod may include, as basic configuration, steps of: obtaining acorrelation model for each element pair of the performance informationby deriving, when the performance items or the controlled units aredesignated as an element of the performance information, a correlationfunction between a first series of performance information thatindicates time series variation about a first element and a secondseries of the performance information that indicates time seriesvariation about a second element and by generating the correlation modelbetween the first element and the second element based on thecorrelation function (Step S11 shown in FIG. 11, for example); andpredicting, by searching for the correlation model for each elementbetween an input element and an output element among elements of theperformance information in series, a value of the output element from avalue of the input element based on the searched correlation model.(Step S12 shown in FIG. 11, for example).

Further, in this data processing method, a step of generating, based onresource information which specifies a range of a value of an element ofthe performance information, when a predicted value of the outputelement predicted by prediction of a value of the output element exceedsthe range, a bottleneck analysis result including the output element andthe value of the output element (Step S13 shown in FIG. 11, for example)may be included.

Hereinafter, detailed processing of the correlation model generation,the model search and the bottleneck analysis will be described.

(Detailed Processing of Correlation Model Generation)

FIG. 12 is an exemplary flowchart of the detailed processing procedureof the correlation model generation in an operations managementapparatus of the first exemplary embodiment.

In the detailed processing of the correlation model generation in thefirst exemplary embodiment, first, information collection unit 122collects an operation state of service executor 121 and accumulatesperformance information 12 a shown in FIG. 3 in performance informationstorage processing unit 112.

Correlation model generation unit 123 reads performance information 12 afrom performance information storage processing unit 112 (Step S101shown in FIG. 12).

Next, correlation model generation unit 123 determines presence orabsence of an element of performance information which has not beenanalyzed yet (Step S102).

In a state that a correlation model is not generated, correlation modelgeneration unit 123 moves to processing to calculate a transformfunction between elements of the performance information (Step S103),because there are elements of the performance information which have notbeen analyzed yet.

First, correlation model generation unit 123 calculates a transformfunction between a series of element SV1-CPU and a series of SV1-MEM ofperformance information 12 a. In case of FIG. 7, correlation modelgeneration unit 123 determines transform function G300 where SV1-CPU isset as input x and SV1-MEM as output y following system identificationprocessing G301.

There are several techniques in such system identification. For example,using the formula y=Ax(t)+Bx(t−1)+Cx(t−2)+Dy(t−1)+Ey(t−2)+F, a value ofvariables A-F is determined so that values of time series of ycalculated from x become closest to values of y detected actually.

Hereinafter, in order to simplify a description, a case where A and B ofthe formula y=Ax+B are determined will be described. Even when othersystem identification methods are used, if a transform function that cancalculate from a series of individual performance information of oneelement of performance information a series of individual performanceinformation of another element of performance information is used, thesimilar effect is obtained.

In System identification processing G301 of FIG. 7, y=Ax+B is selectedas a function, and −0.6 and 100 are determined as a value of A and Brespectively which can approximate graph G102 from graph G101 (Step S103shown in FIG. 12).

As shown in graph G302, in system identification processing G301, aseries of predicted values of SV1-MEM calculated using this transformfunction and a series of values of SV1-MEM detected actually (graphG102) are compared. System identification processing G301 thencalculates a weight of the transform function from a difference betweenthem (a conversion error) (Step S104 shown in FIG. 12) <that is, aweight calculation step or a weight calculation function>.

Correlation model generation unit 123 adds the calculated transformfunction and the weight to correlation models of correlation modelinformation storage processing unit 116 (Step S105).

FIG. 8 is an example of a correlation model added in this way. As acorrelation model between element SV1-CPU and SV1-MEM, the values of A,B and W are accumulated.

Subsequently, in the same way, by performing processing of StepsS103-S105 to all combinations of a sequence of each element included inperformance information 12 a, correlation models about currentperformance information of the system are established in correlationmodel storage processing unit 116.

(Detailed Processing of Model Search)

Next, detailed processing of the model search in the first exemplaryembodiment will be described with reference to FIG. 5, FIG. 13 and FIG.9. FIG. 13 is an exemplary flowchart of the detailed processingprocedure of the model search in an operations management apparatus ofthe first exemplary embodiment.

Model searching unit 124 receives a value of one element of performanceinformation from bottleneck analysis unit 125 (Step S201) and reads acorrelation model from correlation model information storage processingunit 116 (Step S202).

First, model searching unit 124 determines presence or absence of acorrelation which has not been searched yet (Step S203). In the initialstate, since a predicted value of performance information is in thestate not calculated at all, and thus there are correlations notsearched yet, model searching unit 124 shifts to processing (Step S204)to calculate a value of another element.

Model searching unit 124 calculates a value of another element using atransform function from the received value of the one element, andrecords the weight of the transform function used for the calculation(Step S204).

Next, model searching unit 124 determines presence or absence of a valuethat has been already calculated last time for the element for whichcalculation has been performed newly (Step S205). In the firstcalculation, because there are no such already-calculated values, theprocessing returns to the step (Step S203) to search a correlation whichhas not been searched yet.

Because the value of the element received from bottleneck analysis unit125 at the beginning is determined, model searching unit 124 selects oneof values of elements with its value already calculated other than thereceived element, and calculates a value of another element based onthis one of values that has been already calculated. Model searchingunit 124 calculates a value and a weight of the element which is thetarget of the calculation from the selected one of values of elementsthat have been already calculated using a transform function (StepS204).

Model searching unit 124 determines presence or absence of the valuethat has been already calculated last time for the element for whichcalculation is made newly (Step S205). When there is a value that hasbeen already calculated last time, model searching unit 124 compares theweights of the last computed value of the element of performanceinformation and this computed value, and selects a value according tothe weights (Step S206).

As shown in FIG. 9, supposing y and z have been calculated from x lasttime, the computed value of y has the weight 0.7 that the transformfunction of y=2x has. Similarly, the computed value of z has the weight0.8 that the transform function of z=3.9x has. When z is calculated fromy, model searching unit 124 obtains the weight of 0.63 by multiplyingthe weight 0.9 which the transform function of z=2y has by the weight0.7 that the value of y has. Because the weight 0.8 of the computedvalue of z last time is larger than this value, model searching unit 124selects the last-time-computed value of z as the predicted value of z(Step S206) and returns to Step S203.

Thus, model searching unit 124 calculates a value of another element(output element) from a value of one element (input element) ofperformance information through a plurality of routes, and selects aroute with the largest weight. As a result, model searching unit 124 canfinally select, from a plurality of routes, a value that has beencalculated by a combination of transform functions that can correctlypredict a value of an element as the value of the another element(output element).

(Detailed Processing of Bottleneck Analysis)

Next, detailed processing of the bottleneck analysis in the firstexemplary embodiment will be described with reference to FIG. 5, FIG.14, FIG. 10 and FIG. 15. FIG. 14 is an exemplary flowchart of thedetailed processing procedure of the bottleneck analysis in anoperations management apparatus of the first exemplary embodiment.

First, as shown in FIG. 14, in the bottleneck analysis, bottleneckanalysis unit 125 determines an element (input element) of performanceinformation to be input of a system (Step S301).

For a three-tier system including a WEB, an AP and a DB, for example, anelement to be an input includes input traffic or the like to a Webserver. A value of the element includes the maximum value or the likedetected at present, for example.

Next, bottleneck analysis unit 125 hands a value of the determinedelement of the performance information to model searching unit 124 andperforms model search (Step S302). Model searching unit 124 searches thecorrelation models and calculates a value of another element (outputelement) from the value of the input element provided. Next, bottleneckanalysis unit 125 receives the calculated value of the another elementand compares it with resource information 118 a accumulated in resourceinformation storage processing unit 118 to calculate the rate ofutilization of the another element (Step S303).

For example, when model search in which the current value of SV1-CPU isgiven as a value of an input element is performed, bottleneck analysisunit 125 compares the value of SV2-CPU calculated as an output elementwith the minimum and the greatest values of SV2-CPU included in resourceinformation 118 a of FIG. 10.

Then, bottleneck analysis unit 125 determines whether performancecapacity is lacking or not (Step S304).

When being determined that the performance capacity is short at StepS304, bottleneck analysis unit 125 shows the analysis result to anadministrator (Step S306).

On the other hand, when being determined that the performance capacityis not lacking at Step S304, bottleneck analysis unit 125 increases thevalue of the input element in sequence (Step S305) and repeatsprocessing after Step S302.

For example, in Step S304, when the computed value of SV2-CPU is in therange of the minimum and the greatest values specified in resourceinformation 118 a, bottleneck analysis unit 125 determines that theperformance capacity is not lacking, and performs model search againincreasing certain quantity of the value of SV1-CPU (Step S305).

In the same way, bottleneck analysis unit 125 performs model search,increasing the value of the input element in sequence, and when one ofthe calculated values of the element exceeds the specified range inresource information 118 a, determines that the performance capacity islacking and indicates the analysis result to an administrator (StepS306).

FIG. 15 is a screen which is shown to an administrator as a result ofthe bottleneck analysis. Display screen U100 includes output elementSV2-CPU which is short of the performance capacity and the value 600/secof the input element as of that moment.

As a result, administrator can learn that service executor 121 of thecurrent state cannot endure the situation where the input element isbeyond 600/sec, and that if any more load is expected, setting changesand equipment reinforcement is needed so that the processing capacity ofSV2 will be improved.

Here, in generation of the correlation model, a weight of thecorrelation model between each of the elements may be calculated basedon an error of a value of a second element predicted from a value of afirst element using a correlation function and a value of the secondelement acquired. In this case, in a prediction of a value of the outputelement, when different values can be predicted depending on a pluralityof correlation models for the output element, one value of the outputelement may be determined based on the weight.

In generation of the bottleneck analysis result, elements sequenced by arate of utilization may be included in the bottleneck analysis result.

Further, in generation of the bottleneck analysis result, the inputelement and the value of the input element at the moment when a value ofthe output element exceeds the range may be included in the bottleneckanalysis result.

In generation of the correlation model, a first weight of thecorrelation model between the first element and the second element, asecond weight of the correlation model between the first element and athird element and a third weight of the correlation model between thethird element and the second element may be calculated respectively. Inthis case, it is possible to compare an aggregated weight of the secondweight and the third weight to the first weight to predict a value ofthe output element.

According to the first exemplary embodiment, correlation modelgeneration unit generates correlation models of the overall operatingstate of a system using a transform function between each element ofperformance information as described above. When a value of one element(input element) is supposed, a model searching unit calculates a valueof another element (output element) by tracing transform functions inthe correlation models in sequence. A bottleneck analysis unit increasesor decreases a value of one input element in sequence to detect anoutput element for which a value calculated by a model searching unit isbeyond a limit, and generates an analysis result including the outputelement and the value of the input element as of that moment.

As a result, by generating correlation models of performance informationautomatically from detected performance information to perform abottleneck analysis, the first exemplary embodiment possesses the effectthat a bottleneck of service executor 121 can be analyzedcomprehensively. In the first exemplary embodiment, a value of anelement can be predicted more correctly using a plurality of routes inall correlation models based on a correlation between elements ofperformance information detected by actual practical use. Accordingly,the first exemplary embodiment possesses the effect that there is noneed to depend on administrator's experience for verification of ananalysis result. Because a correlation model generated includes atransform function that converts between elements of performanceinformation in 1 to 1, one element of performance information can bederived from another element of performance information easily.Accordingly, even if a system is magnified, the first exemplaryembodiment possesses the effect that there is no possibility that theamount of processing becomes enormous.

As a result of the bottleneck analysis, an operations managementapparatus of the first exemplary embodiment indicates an output elementwhich is beyond a limit of the performance and the input element as ofthat moment. Thus, an operations management apparatus of the firstexemplary embodiment can show to an administrator clearly that attentionto which part of a system is required in terms of performance bypresenting both information of the value of maximum performance of thesystem and information which part will be a bottleneck then. Anoperations management apparatus of the first exemplary embodiment canmake clear that which element of a system should be reinforced to copewith an assumed future load.

Thus, in contrast with related technology where only a partial or adoubtful analysis can be realized depending on administrator'sexperience and sense, the first exemplary embodiment possesses theeffect that a bottleneck analysis can be realized automatically withoutdepending on the ability of an administrator, comprehensively over theentire system without increasing a load, and correctly based on anactual system operating status.

In the first exemplary embodiment, one predicted value is selected froma plurality of predicted values of an element based on a weight.However, a predicted value of an element may be calculated by carryingout a predetermined operation to the calculation result of a value ofeach element based on a weight. A predicted value of an element may befound by performing pruning of a route of a correlation model based on aweight. Even when a different procedure is used, if a value of anotherelement is calculated by searching a correlation model from a value ofone element, the similar effect will be obtained.

In one of related technologies, a model is generated for a temporalchange in one element of performance information, and a predicted valueof the element when time has passed is calculated. Also in anotherrelated technology, a coefficient of correlation between two elements ofperformance information is used. However, it cannot be used for aprediction (bottleneck analysis) of a value of an element, because thecoefficient of correlation is not a transform function. Although thecoefficient of correlation can support malfunction detection, it cannotbe used for analyzing a bottleneck, because even if one value is foundthe other cannot be calculated.

In contrast, an operations management apparatus of the first exemplaryembodiment generates a model using a transform function between elementsof performance information. A correct value of an element of performanceinformation can be predicted for each element configuring a system,because an operations management apparatus of the first exemplaryembodiment can calculate a value of another element when a value of oneof performance information increases. Consequently, analysis of anelement which will be a bottleneck can be done correctly.

Thus, in an operations management apparatus of the first exemplaryembodiment, a correlation model of performance information is generatedautomatically from detected performance information to perform abottleneck analysis. Accordingly, the first exemplary embodimentpossesses the effect that a bottleneck can be analyzed according tosituations during operation including conditions failed to be assumed atthe time of a test. The first exemplary embodiment also possesses theeffect that it can analyze not only specific processing assumed inadvance but also all service executors' behavior comprehensively.

Furthermore, verification of an analysis result does not need to dependon administrator's experience, because an operations managementapparatus of the first exemplary embodiment can extract a bottleneckwith a high possibility to occur in a targeted system in the futurebased on a correlation between elements of performance informationdetected by actual practical use. In an operations management apparatusof the first exemplary embodiment, a value of another element can bederived from a value of one element of performance information easily,because a generated correlation model includes a transform function thatconverts between elements of performance information in 1 to 1.Accordingly, even if a system is magnified, an operations managementapparatus of the first exemplary embodiment can analyze a bottleneckwithout the amount of processing becoming enormous.

Thus, the first exemplary embodiment possesses the effect that abottleneck which may occur in an actual operational situation can bepredicted correctly, because modeling is performed by extracting acorrelation of detected performance information appropriately. The firstexemplary embodiment possesses the effect that it can realize abottleneck analysis in which administrator's burden is low and whichdoes not increase a processing load that is also needed for an analysisin the large-scale environment.

In an operations management apparatus of the first exemplary embodiment,correlation model generation unit generates a weight that indicatescorrectness of each transform function, and when different values arecalculated depending on a plurality of transform functions to oneelement of performance information, a model searching unit calculatesone value based on the weight. As a result, the first exemplaryembodiment has the effect that it can analyze a bottleneck morecorrectly, because a value of an element of performance information canbe calculated more correctly using a plurality of routes in allcorrelation models.

Further, in an operations management apparatus of the first exemplaryembodiment, an administrator dialogue unit shows an output element whichis beyond the limit of the performance and the input element as of thatmoment as an analysis result of a bottleneck analysis unit. Thus, thefirst exemplary embodiment possesses the effect that it can make clearwhich element of a system should be reinforced to cope with an assumedfuture load, by presenting both information of the value of maximumperformance of the system and information which part will be abottleneck then.

In an operations management apparatus of the first exemplary embodiment,an administrator dialogue unit indicates an output element which isbeyond the limit of the performance as well as the other elements in theorder corresponding to the rate of utilization. As a result, the firstexemplary embodiment possesses the effect that it can show to anadministrator clearly that attention to which part of a system includingthe other elements of performance information is required in terms ofperformance.

Here, by a computer executing various programs stored in a suitablememory, some of blocks in the block diagram shown in FIG. 5 (such asblocks indicated by the symbols 123, 124, 125, 121, 122, 126, 127 and128, for example) may be a software module which indicates a statefunctionalized by the program.

That is, although the physical composition of the first exemplaryembodiment is of one or more CPUs (or, one or more CPUs and one or morememories) or the like, for example, software structure by each unit(circuit and means) expresses a plurality of functions that CPU exhibitsunder control of a program as a component by a plurality of units(means) respectively.

When a dynamic state where the CPU is operated by a program (a statewhere each procedure configuring the program is being executed) isexpressed functionally, it can be considered that each part (means) isstructured inside the CPU. In a static state where the program is notbeing executed, an entire program for enabling structuring of each means(or each program part included in the structure of each means) arestored in a storage area such as a memory.

It is naturally understood that the explanations of each unit (means)provided above is understood as describing a computer functionalized byprograms along with the functions of the programs, or as describing anapparatus includes a plurality of electronic circuit blocks that arefunctionalized permanently with specific hardware. Therefore, thosefunctional blocks can be achieved in various kinds of forms such as onlywith hardware, only with software, or combination of those, and it isnot intended to be limited to any one of those.

Each unit may be configured as a device including a dedicated computerwhich can communicate, and an operations management system may beconfigured by these devices.

[Second Exemplary Embodiment]

Next, a second exemplary embodiment will be described based on FIG. 16,FIG. 17, FIG. 18, FIG. 19, FIG. 20 and FIG. 21. In the followingdescription, description of a substantially similar configuration to thefirst exemplary embodiment will be omitted, and only different parts arestated. FIG. 16 is an exemplary block diagram of the entire structure ofan operations management apparatus in the second exemplary embodiment.

A configuration in second exemplary embodiment includes totalperformance information manager 231 in addition to the configurationdescribed using FIG. 5 of the first exemplary embodiment.

As shown in FIG. 16, operations management apparatus 200 of secondexemplary embodiment includes total performance information manager 231in addition to service executor 221, performance information storageprocessing unit 212, information collection unit 222, analysis settingstorage processing unit 214, failure analysis unit 226, administratordialogue unit 227, handling executing unit 228, correlation modelgeneration unit 223, correlation model information storage processingunit 216, model searching unit 224, resource information storageprocessing unit 218 and bottleneck analysis unit 225 which are the samecompositions as in the first exemplary embodiment.

Resource information storage processing unit 218 accumulates totalperformance information calculated from a plurality of elements ofperformance information and group information which designates acombination of a plurality of target elements of the calculation inaddition to information described in FIG. 5.

Total performance information manager 231 receives the group informationfrom resource information storage processing unit 218 and instructscorrelation model generation unit 223 to generate total performanceinformation. Total performance information manager 231 directs modelsearching unit 224 to update the value of total performance information.

Correlation model generation unit 223 generates total performanceinformation which takes time series of values calculated by applying apredetermined arithmetic operation to the value of a plurality ofelements of performance information detected simultaneously according toa direction of total performance information manager 231 as a value ofan element in addition to the function of the first exemplaryembodiment. Correlation model generation unit 223 adds this totalperformance information to the performance information to generate acorrelation model.

When a value of an element of performance information is predicted,model searching unit 224 recalculates the value of total performanceinformation following directions from total performance informationmanager 231 (total performance information re-calculation function) inaddition to the function of the first exemplary embodiment.

FIG. 17 is another exemplary block diagram of the entire structure of anoperations management apparatus of the second exemplary embodiment. Asshown in FIG. 17, each unit of operations management apparatus 200 mayinclude a plurality of functions of a control unit.

Total performance information manager 231 may group elements andcalculate the total value of the elements which are grouped. In thiscase, correlation model generation unit 223 may add a grouped elementwhich includes the above mentioned total value to the performanceinformation as a new element, and generate a correlation model from acorrelation between one of the new elements and another of the newelements.

In operations management apparatus 200, the outline of correlation modelgeneration using total performance information will be described. FIG.18 is an exemplary diagram of total performance information generationin an operations management apparatus of the second exemplaryembodiment.

As shown in FIG. 18, configuration graph G320 indicates the compositionof a load distribution system including three layers of WEB layer, APlayer and DB layer. The load of WEB layer is shared by three servers,and the load of AP layer is shared by two servers. Elements A-C ofperformance information indicate the performance of each server for WEBlayer, and similarly, elements D-E and element F indicate performancefor AP layer and DB layer, respectively.

Correlation graph G321 is an example of a correlation model generated byoperation described in the first exemplary embodiment. In this example,a correct correlation has been generated at each layer where sameprocessing is dispersed to be carried out, while a significantcorrelation has not been generated between the layers.

Correlation graph G322 is an example of a correlation model generatedusing total performance information of the second exemplary embodiment.In this example, as total performance information, an element X with thesum of the values of the elements of WEB layer and an element Y with thesum of the values of the elements of AP layer are generatedrespectively. As a result, a correct correlation is generated betweenthe layers.

Thus, a correlation between each layer is generated by using totalperformance information.

Next, a data structure of resource information 118 b of resourceinformation storage processing unit 218 which accumulates totalperformance information will be described. FIG. 19 is an exemplarydiagram of a data structure of resource information in an operationsmanagement apparatus of the second exemplary embodiment.

A new attribute, Group, is added to the resource information 118 b inaddition to the information on resource information 118 a shown in FIG.10.

As group information, elements required for calculation of totalperformance information is enumerated for elements X and Y of totalperformance information.

For example, element X of total performance information has elements A,B and C of WEB layer indicated in configuration graph G320 of FIG. 18 asgroup information. Also, element Y of total performance information haselements D and E of performance information of AP layer indicated inconfiguration graph G320 of FIG. 18 as group information. Groupinformation is not described for elements other than the elements oftotal performance information.

By providing an item of group information in resource information 118 a,and by grouping the value of each element, operations managementapparatus 200 manages total performance information.

(Processing Procedure)

Next, processing of each unit in an operations management apparatusincluding the above-mentioned configurations will be also realized as amethod, and thus various processing procedures will be described as adata processing method with reference to FIGS. 20 and 21.

(Detailed Processing of Correlation Model Generation)

FIG. 20 is an exemplary flowchart of the detailed processing procedureof correlation model generation in an operations management apparatus ofthe second exemplary embodiment.

In FIG. 20, Step S402 which generates total performance information isadded in addition to Steps S401 and S403-S406 which are the same stepsas Steps S101-S105 described using FIG. 12 in the first exemplaryembodiment.

The detailed processing of the correlation model generation in thesecond exemplary embodiment is similar to one described in the firstexemplary embodiment, but different in a point that Step S402 whichgenerates total performance information is performed following Step S401which reads performance information.

Referring to FIG. 20, correlation model generation unit 223 readsperformance information from performance information storage processingunit 212 (Step 401) and generates total performance informationaccording to a direction of total performance information manager 231(Step 402).

In this case, total performance information manager 231 reads resourceinformation 118 b from resource information storage processing unit 218,searches elements X and Y of total performance information for whichgroup information is designated, and directs correlation modelgeneration unit 223 to calculate the value of these elements X and Y.

Correlation model generation unit 223 adds values of elements A, B and Cof performance information at the same clock time following thedirection and generates time series of values of element X.

Similarly, time series of element Y is generated from elements D and E.

Henceforth, correlation model generation unit 223 adds elements X and Yof total performance information to the elements accumulated inperformance information storage processing unit 212 and generates acorrelation model. As described in the first exemplary embodiment,correlation model generation unit 223 repeats generation of a transformfunction (Step 404), calculation of an error (Step 405) and addition ofa correlation model (Step 406) until there is no performance informationwhich has not been analyzed (Step 403).

FIG. 18 is an example of a correlation model generated in this way.

As shown in FIG. 18, configuration graph G320 shows a system with a 3layer composition of WEB, AP and DB which include three servers, twoservers and one server, respectively.

When a correlation of performance information on each server is modeled,there may be a case where a correlation between each layer is notgenerated appropriately, as shown in correlation graph G321. Or, thereis a case where although a correlation between each layer can begenerated, an error of the correlation model may be very large.

For example, the processing load of DB layer appears only in element Fof performance information, while the processing load of AP layerappears being dispersed in elements D and E because the load is sharedby the two servers.

Here, when a correlation between element D and element F is considered,the value of the element F depends on the summation of the value ofelement D and element E. When processing by element D and element E isquite even, the value of the element F is correlated with two times ofthe value of element D. However, when there is a bias between processingassociated with element D and processing associated with element E, thevalue of element F cannot be identified correctly only from the value ofelement D.

Similarly, a correlation between element E and element F is weak. Thesame problem also occurs between WEB layer and AP layer, and acorrelation from elements A, B and C to elements D and E is weak. As aresult, as shown in correlation graph G321, only a partial correlationis extracted.

Generally, in order to resolve such a problem, a correlation model isgenerated using a transform function of N vs. 1, not a transformfunction of 1 to 1 of elements. However, as the number of elements ofperformance information increases, enormous calculation resources areneeded. Further, when a transform function with N inputs and one outputis used for generation of a correlation model, the N inputs has to bedetermined in order to calculate a value of one certain element.Accordingly, it is difficult to perform an analysis such as which part asystem will be a bottleneck when one input load of the system increases.

Accordingly, in case of correlation model generation using totalperformance information according to the second exemplary embodiment, asshown in correlation graph G322, elements X and Y are generated inaddition to elements A-F which are detected actually. Element Y is thetotal of the values of elements D and E of AP layer. By element Y, thesystem can be handled as if there is one server in AP layer.

As a result, a clear correlation can be generated between the element Yindicating the processing load of whole AP layer and element Findicating the processing load of whole DB layer. In the same way, acorrelation can be generated between element X which indicates whole WEBlayer and element Y which indicates whole AP layer.

(Detailed Processing of Model Search)

FIG. 21 is an exemplary flowchart of the detailed processing procedureof model search in an operations management apparatus of the secondexemplary embodiment.

In FIG. 21, Step S507 which determines group designation and Step S508which recalculates total performance information are added in additionto Steps S501-S506 which are the same steps as Steps S201-S206 describedusing FIG. 13 in the first exemplary embodiment.

Referring to FIG. 21, the operation of model search in the secondexemplary embodiment is similar to one described in the first exemplaryembodiment, but different in a point that, following Step S506 whichdetermines a value of an element of performance information, Step S507for determining whether the determined value is used for totalperformance information and Step S508 which recalculates totalperformance information are added.

In order to calculate another performance value for a certain inputperformance value, model searching unit 224 reads a correlation modelincluding total performance information, and performs search (StepsS501-S506). When calculated values of elements are used for calculationof total performance information (Step S507), model searching unit 224recalculates total performance information using the new values of theelements following directions of total performance information manager231 (Step S508).

Bottleneck analysis unit 225 identifies the maximum performance of thesystem and an element which will be a bottleneck by repeatingcalculation of a value of an element of performance information by suchmodel search.

Referring to FIG. 19, information for bottleneck analysis unit 225 todetermine the rate of utilization of total performance information (theunit, the minimum and the maximum of a value of an element of totalperformance information) are included in resource information 118 b.

For example, the maximum value of elements A, B and C is 100%.Accordingly, the maximum value of element X of total performanceinformation will be 300% according to the total of the maximum values ofelements A, B and C. The maximum value of elements D and E is 1000 Mbps.However, there is a case where a network band may not be obtained bytotaling, and thus the maximum value of element Y of total performanceinformation will be 1000 Mbps. Bottleneck analysis unit 225 analyzeswhich element will be a bottleneck based on this resource information302.

Here, for example, when element A of FIG. 18 is designated as inputelement, values of elements B and C can be calculated from the value ofelement A based on a correlation in the same WEB layer. The value ofelement X can be calculated from the total of the values of elements A,B and C. The value of element Y and element F can be calculated fromelement X.

The value of elements D and E in the group of element Y can also becalculated from the value of element Y.

As a result, when a load associated with element A is increasing, a loadassociated with element F which is a DB server can be calculatedcorrectly.

In generating the correlation model, the elements are grouped, the totalvalue of elements which are grouped is calculated, a grouped elementwith the total value is added to the performance information as a newelement, and a correlation model is generated from a correlation betweenone of the new elements and another of the new elements.

As mentioned above, according to second exemplary embodiment,correlation model generation unit generates a correlation modelincluding total performance information obtained by performing apredetermined arithmetic operation on a plurality of elements ofdetected performance information following a direction of totalperformance information manager 231, while exhibiting the same operationeffect as the first exemplary embodiment. Then, model searching unit 224predicts a value of the performance information using correlation modelsincluding total performance information.

As a result, for example, even when a value of one element ofperformance information is related to the total of the values of aplurality of elements such as in load sharing processing, an operationsmanagement apparatus can analyze a bottleneck correctly withoutincreasing the amount of processing. Thus, in comparison with relatedtechnology for which the enormous processing load is needed, the secondexemplary embodiment possesses the remarkable effect that a correctbottleneck analysis where a correlation with a group including aplurality of elements is also taken into account while suppressingincrease of the processing load only to an increase associated with theincreased number of the elements of total performance information can berealized in addition to the effect of the first exemplary embodiment.

In second exemplary embodiment, a value of an element of totalperformance information is the summation of a value of each elementwhich is grouped. However, the value of an element of total performanceinformation may be calculated by carrying out a predetermined operationon a value of each element which is grouped.

In the second exemplary embodiment, although the description has beenmade in the form that total performance information manager directscalculation of a value of total performance information to a correlationmodel generation unit and a model searching unit, the embodiment is notlimited to this. There may be a form where total performance informationmanager writes a value of total performance information in a performanceinformation storage processing unit directly. Also there may be a formwhere total performance information manager adds an attribute thatindicates a dependency relationship of a group to a correlation model ina correlation model information storage processing unit, and a modelsearching unit performs search. Even when a different procedure is used,if new performance information is generated by applying predeterminedcalculation to detected performance information and is used forsearching, the similar effect will be obtained.

Thus, correlation model generation unit generates a correlation modelincluding total performance information obtained by performing apredetermined arithmetic operation on a plurality of elements ofdetected performance information following directions of totalperformance information manager. Then, a model searching unit predicts avalue of performance information using correlation models includingtotal performance information. As a result, for example, even when avalue of one element of performance information is related to the totalof the values of a plurality of elements such as in load sharingprocessing, an operations management apparatus can analyze a bottleneckcorrectly without increasing the amount of processing.

Other structures, other steps, functions and the operational effectsthereof are the same as those of the case of the first exemplaryembodiment described above. Further, the content of operation of eachstep and the structural elements of each unit and functions realized bythem described above may be put into a program to be executed by acomputer.

[Third Exemplary Embodiment]

Next, a third exemplary embodiment will be described based on FIG. 22.In the following description, description of a substantially similarconfiguration to the first exemplary embodiment will be omitted, andonly different parts are stated. FIG. 22 is an exemplary block diagramof the entire structure of a operations management apparatus in thethird exemplary embodiment.

An operations management apparatus in the third exemplary embodimentincludes an analysis setting generation unit in addition to theconfiguration described using FIG. 13 in the second exemplaryembodiment.

As shown in FIG. 22, operations management apparatus 300 of a thirdexemplary embodiment includes analysis setting generation unit 332 inaddition to service executor 321, performance information storageprocessing unit 312, information collection unit 322, analysis settingstorage processing unit 314, failure analysis unit 326, administratordialogue unit 327, handling executing unit 328, correlation modelgeneration unit 323, correlation model information storage processingunit 316, model searching unit 324, resource information storageprocessing unit 318, bottleneck analysis unit 325 and total performanceinformation manager 331 which are the same compositions as in the secondexemplary embodiment.

Analysis setting generation unit 332 receives a bottleneck analysisresult from bottleneck analysis unit 325 and generates an additionalsetting to monitor and analyze an element of performance informationwhich is expected to be a bottleneck in failure analysis unit 326.Analysis setting generation unit 332 corrects analysis settingaccumulated in analysis setting storage processing unit 314 according tothis additional setting.

Bottleneck analysis unit 325 receives administrator's input fromadministrator dialogue unit 327 and instructs analysis settinggeneration unit 332 to correct setting information.

FIG. 23 is another exemplary block diagram of the entire structure of anoperations management apparatus of the third exemplary embodiment. Here,as shown in FIG. 23, each unit of operations management apparatus 300may include a plurality of functions of a control unit.

Analysis setting generation unit 332 may add a monitoring setting inwhich an output element included in a bottleneck analysis result is themonitoring subject of a failure analysis.

(Processing Procedure)

Next, processing of each unit in an operations management apparatusincluding the above-mentioned configurations will be also realized as amethod, and thus various processing procedures will be described as adata processing method with reference to FIG. 24 to 26.

FIG. 24 is an exemplary flowchart of the detailed processing procedureof the analysis setting generation in an operations management apparatusof the third exemplary embodiment.

FIG. 25 is an exemplary diagram of an indicated display screen in anoperations management apparatus of the third exemplary embodiment. Anoperation button of Analysis Setting is added in addition to the displayscreen described using FIG. 15 in the first exemplary embodiment.

FIG. 26 is another exemplary diagram of an indicated display screen inan operations management apparatus of the third exemplary embodiment. Adisplay screen of FIG. 26 is called from the operation button ofAnalysis Setting in FIG. 25, and used for an administrator to checkwhether a setting change is possible or not.

Referring to FIG. 24, first, bottleneck analysis unit 325 performsbottleneck analysis processing (Step S601). The operation of abottleneck analysis in the third exemplary embodiment is same as theones described in the first and second exemplary embodiment.

Analysis setting generation unit 332 receives a result of the bottleneckanalysis from bottleneck analysis unit 325, refers to an analysissetting of analysis setting storage processing unit 314, and when anelement which is being a bottleneck is not assigned as a target offailure analysis (Step S602), adds a monitoring setting to monitor theelement (Step S603).

When an element added to the monitoring settings before is judged to besafe (the risk of the element is decreased) in the current bottleneckanalysis result (Step S604), the monitoring setting is deleted (StepS605).

By these Steps S601-S605, it is possible to make the output elementincluded in the bottleneck analysis result a monitoring subject of thefailure analysis.

An example of a display screen displayed on a display unit of anoperations management apparatus is shown in FIG. 25. This Figure is anexample of a display screen in the bottleneck analysis.

In a display screen U200, a fourth display operating portion U246 thatis an operation button of Analysis Setting is added in addition toanalysis result display portion U210, element list display portion U220,graph display portion U230, a first display operation portion U242indicating detailed information of a correlation model, second displayoperation portion U244 indicating detailed information of resourceinformation and third display operation portion U248 terminatingdisplaying the bottleneck analysis screen which are the sameconfiguration as display screen U100 shown in FIG. 15.

Display screen U300 shown in FIG. 26 is indicated by pushing down fourthdisplay operating portion U246.

Display screen U300 (analysis rule setting screen) includes analysisrule display setting portion U320 to set an analysis rule, analysis rulelist display portion U330 where analysis rules currently set arelist-displayed, message display portion U310 which indicates a messageof whether an analysis rule is added or not, and display operationsections U342 and U344 to confirm completion of a setting on theanalysis rule setting screen.

Here, an administrator confirms whether an output element included in abottleneck analysis result is not leaking from monitoring targets andcorrects the analysis settings if needed.

As mentioned above, according to the third exemplary embodiment, ananalysis setting generation unit generates an additional setting for afailure analysis unit to monitor and analyze an element of performanceinformation which is expected to be a bottleneck, while exhibiting thesame operation effect as the first exemplary embodiment. As a result,the third exemplary embodiment has the effect that, for a bottleneckfound newly by analyzing a system comprehensively, it is possible towatch the element of the bottleneck continually, and consequently moreappropriate operations management can be performed.

Other structures, other steps, and the operational effects thereof arethe same as those of the case of the first exemplary embodimentdescribed above. Further, the content of operation of each step and thestructural elements of each unit and functions realized by themdescribed above may be put into a program to be executed by a computer.

[Other Various Modifications]

Although the device and method according to the present invention havebeen described according to specific exemplary embodiments, it ispossible to modify the exemplary embodiments described in various wayswithout departing from the scope of the present invention.

For example, the number, position and shape or the like of theabove-mentioned constructional elements are not limited to theabove-mentioned exemplary embodiments, and the number, a position and ashape or the like which are suitable when the present invention isimplemented can be selected. That is, in the above-mentioned exemplaryembodiments, although elements of performance information are grouped inWEB layer, AP layer and DB layer when total performance information iscalculated, the present invention does not limit the number of layersthereof. An element of performance information may be grouped accordingto other various classifications.

The operation control managing software according to the presentinvention may be installed in one PC, or it may be installed in aconfiguration which can be used by a terminal and a server in aclient/server system or in P2P environment. Further, the various displayscreens may have a configuration accessible on the web.

In an operations management apparatus according to an aspect of theexemplary embodiment including a service executor which provides aninformation and communications service such as a WEB service and abusiness service, a performance information storage processing unitwhich accumulates each element of performance information of the serviceexecutor, an information collection unit which detects and outputs anoperation state of the service executor and accumulates the performanceinformation included in the operation state in the performanceinformation storage processing unit, an analysis setting storageprocessing unit which accumulates an analysis setting to detectabnormality of the service executor, a failure analysis unit whichreceives the operation state from the information collection unit andperforms a failure analysis according to a analysis setting of theanalysis setting storage processing unit, an administrator dialogue unitwhich receives a result of the failure analysis from the failureanalysis unit to show it to an administrator and accepts administrator'sinput, an handling executing unit which carries out processing which isan handling for a failure on the service executor according to ainstruction of the administrator dialogue unit, the operationsmanagement apparatus may include: a correlation model generation unitwhich generates a correlation model of the overall operating state ofthe service executor by taking out performance information for apredetermined period from the performance information storage processingunit, and by repeating, for all elements of performance information,processing of deriving, for time series of values of any two elements ofperformance information, a transform function for a case where oneelement is an input and the other an output; a correlation modelinformation storage processing unit which accumulates the correlationmodel which the correlation model generation unit generated; a modelsearching unit which predicts a value of another element (outputelement) by tracing transform functions between each element of thecorrelation model of the correlation model information storageprocessing unit in sequence when a value of one element (input element)of performance information is supposed; a resource information storageprocessing unit which accumulates resource information which isinformation which describes an attribute such as the maximum value, theminimum value and the unit of an element of the performance information:and a bottleneck analysis unit which instructs the model searching unitto predict a value of another element (output element) by increasing ordecreasing the value of one input element designated in advance amongelements of the performance information in sequence, and receives avalue of another element (output element) predicted by the modelsearching unit and compares the predicted value with resourceinformation in the resource information storage processing unit, andwhen the predicted value of the another element (output element) exceedsa limit, generates an analysis result including the output element andthe value of the input element as of that moment, and outputs the resultto the administrator dialogue unit may be included. In this operationsmanagement apparatus, the correlation model generation unit generatescorrelation models of the overall operating state of the serviceexecutor as a transform function between two elements of performanceinformation. When the value of one element (input element) ofperformance information is supposed, a value of another element (outputelement) is predicted by the model searching unit by tracing thetransform functions in the correlation models in sequence. Bottleneckanalysis unit receives a value of the another element (output element)predicted by the model searching unit by increasing and decreasing thevalue of the one element (input element) in sequence, and when a valueof another element (output element) predicted exceeds a limit, generatesan analysis result including the output element and the value of theinput element as of that moment.

Thus, by generating a correlation model of performance informationautomatically from detected performance information to perform abottleneck analysis, this operations management apparatus can analyze abottleneck in conformity with a situation at the time of operationincluding situations failed to have been assumed at the time of a test.This operations management apparatus can analyze not only behaviorrelated to specific processing which is assumed in advance but also thewhole behavior of the service executor comprehensively.

Furthermore, because the operations management apparatus can extract abottleneck which has a high possibility to occur in a targeted system inthe future based on a correlation between elements of performanceinformation detected by actual practical use, verification of ananalysis result does not need to depends on administrator's experience.Also, the correlation model generated includes transform functions thatconvert between elements of performance information in 1 to 1.Accordingly, this operations management apparatus can derive anotherelement from one element of performance information easily, and even ifa system is magnified, can analyze a bottleneck without the amount ofprocessing becoming enormous.

In an operations management apparatus of one aspect of the exemplaryembodiment, the correlation model information storage processing unitaccumulates a weight that indicates correctness of each of the transformfunctions in the correlation models newly; the correlation modelgeneration unit newly includes a function to compare series of values ofan element generated by the transform function with series of actuallydetected values of the output element and calculate a weight of thetransform function from the difference of the values in addition toprocessing to derive the transform function at the time of generation ofthe correlation model; and the model searching unit may newly include afunction to calculate or select one value based on the weight whendifferent values are calculated by a plurality of transform functionsfor one element of performance information.

In this operations management apparatus, a correlation model generationunit generates a weight that indicates correctness of each transformfunction, and when different values are calculated depending on aplurality of transform functions for one element of performanceinformation, a model searching unit calculates one value based on theweight. As a result, the operations management apparatus can analyze abottleneck more correctly, because a value of an element can bepredicted more correctly using a plurality of routes in all correlationmodels.

In an operations management apparatus of one aspect of the exemplaryembodiment, as an analysis result of the bottleneck analysis unit, theadministrator dialogue unit may show a result screen including an outputelement which is beyond a limit of the performance and an input elementat the time when the limit has been exceeded to an administrator.

In this operations management apparatus, administrator dialogue unitshows an output element which is beyond the limit of the performance andthe input element as of that moment, as an analysis result of thebottleneck analysis unit. Thus, which element of a system should bereinforced to cope with an assumed future load can be made clear,because the operations management apparatus presents a value of themaximum performance of the system as well as information which part ofthe system will be a bottleneck at the time of the maximum performance.

In this operations management apparatus, the result screen presented bythe administrator dialogue unit may indicate other elements ofperformance information which are sequenced in order of the rate ofutilization as well as the output element which is beyond a limit of theperformance.

In this operations management apparatus, the administrator dialogue unitpresents other elements of performance information sequenced in order ofthe rate of utilization as well as the output element which is beyond alimit of the performance. As a result, the operations managementapparatus can show to an administrator clearly that attention to whichpart of a system including the other elements of performance informationis required in terms of performance.

In an operations management apparatus of one aspect of the exemplaryembodiment, resource information storage processing unit includes afunction to accumulate newly total performance information calculatedfrom a plurality of elements of performance information and groupinformation which designates a combination of a plurality of targetelements of the calculation; total performance information manager whichreceives the group information of the resource information storageprocessing unit, instructs the correlation model generation unit togenerate total performance information, and directs model searching unitto update the value of total performance information is newly included;the correlation model generation unit newly includes a function thatgenerates total performance information which takes time series ofvalues calculated by performing a predetermined arithmetic operation tothe value of a plurality of elements of performance information detectedsimultaneously following a direction of the total performanceinformation manager as a value of an element, and adds the totalperformance information to the performance information to generate acorrelation model; the model searching unit may newly include a functionthat recalculates the value of total performance information following adirection from total performance information manager when a value of anelement of performance information is predicted.

In the operations management apparatus, a correlation model generationunit generates a correlation model including total performanceinformation obtained by performing a predetermined arithmetic operationon a plurality of elements of the detected performance informationfollowing directions of the total performance information manager, and amodel searching unit predicts a value of performance information usingthe correlation model including the total performance information. As aresult, for example, even when a value of one element of performanceinformation is related to the total of the values of a plurality ofelements such as in load sharing processing, the operations managementapparatus can analyze a bottleneck correctly without increasing theamount of processing, and thus correct analysis can be performed whilesuppressing the load.

An operations management apparatus of one aspect of the exemplaryembodiment may include an analysis setting generation unit newly thatreceives a bottleneck analysis result from the bottleneck analysis unitand generates an additional setting to monitor and analyze an element ofperformance information which is expected to be a bottleneck in thefailure analysis unit, and corrects analysis setting accumulated in theanalysis setting storage processing unit according to the additionalsetting.

In this operations management apparatus, the analysis setting generationunit generates an additional setting for a failure analysis unit toanalyze and monitor an element of performance information which isexpected to be a bottleneck.

An operations management apparatus of one aspect of the exemplaryembodiment may include a function where the bottleneck analysis unitreceives administrator's input from the administrator dialogue unit tocorrect the setting information.

The operations management apparatus can control this analysis setting byadministrator's input. As a result, for a bottleneck found newly byanalyzing a system comprehensively, it is possible to watch the elementof the bottleneck continually, and consequently more appropriateoperations management can be performed.

Thus, since modeling is performed by extracting a correlation ofdetected performance information appropriately, operations managementapparatus can predicts a bottleneck which may occur in an actualoperational situation correctly, and can realize a bottleneck analysisin which administrator's burden is low and which does not increase theprocessing load that is also needed for an analysis in the large-scaleenvironment.

Functions of an operations management apparatus of each of the exemplaryembodiment mentioned above may be realized by a computer and a programas well as by hardware. The program is provided being recorded in acomputer-readable recording medium such as a magnetic disk and asemiconductor memory, and by being read by a computer at a time of itsstart and by controlling operation of the computer, the program can makethe computer function as the means in each of the exemplary embodimentsdescribed above.

(Program)

Further, the software program of the present invention for enabling thefunctions of the exemplary embodiments described above includes: eachprocessing program executed in a program such as a program thatcorresponds to the processing units (processing means), functions andthe like shown in the various block diagrams of each of theabove-described exemplary embodiments and a program that corresponds tothe processing procedures, the processing means, the functions and thelike shown in the flowcharts and the like; and the whole part or a partof the method (steps), the described processing, and the data describedall through the present specification.

Specifically, an operations management program of each exemplaryembodiment can cause a computer provided in an operations managementapparatus which acquires performance information for each of a pluralityof performance items from a plurality of controlled units and managesoperation of the controlled unit to realize various functions.

The operations management program allows a computer to realize a methodincluding the steps of: obtaining a correlation model for each elementpair of the performance information by deriving, when the performanceitems or the controlled units are designated as an element of theperformance information, a correlation function between a first seriesof performance information that indicates time series variation about afirst element and a second series of the performance information thatindicates time series variation about a second element and by generatingthe correlation model between the first element and the second elementbased on the correlation function (symbol 123 shown in FIG. 5 and StepS11 shown in FIG. 11, for example); and predicting, by searching for thecorrelation model for each element between an input element and anoutput element among elements of the performance information in series,a value of the output element from a value of the input element based onthe correlation model searched (symbol 124 shown in FIG. 5 and Step S12shown in FIG. 11, for example).

The operations management program further allows a computer to realize amethod including a step of: generating, based on resource informationwhich specifies a range of a value of an element of the performanceinformation, when a predicted value of the output element predicted byprediction of a value of the output element exceeds the range, abottleneck analysis result including the output element and the value ofthe output element (symbol 125 shown in FIG. 5 and Step S13 shown inFIG. 11, for example).

The operations management program may: calculate, in generation of thecorrelation model, based on an error between a value of a second elementpredicted from a value of a first element using the correlation functionand a value of the second element acquired, a weight of the correlationmodel between the first element and the second element; and determine,in a prediction of a value of the output element, when different valuescan be predicted depending on a plurality of the correlation models forthe output element, one value of the output element based on the weight.

The operations management program may: in generation of the correlationmodel, group the elements, calculate the total value of values ofelements which are grouped, add a grouped element with the total valueto the performance information as a new element, and generate acorrelation model from a correlation between one of the new elements andanother of the new elements.

The operations management program may generate an additional monitoringsetting in which the output element included in the bottleneck analysisresult is a monitoring subject of a failure analysis.

Further, the operations management program may include, in generation ofthe bottleneck analysis result, the elements sequenced in order of therate of utilization in the bottleneck analysis result.

The operations management program may include, in generating thebottleneck analysis result, the input element and a value of the inputelement at the time when a value of the output element exceeds the rangein the bottleneck analysis result.

Further, the operations management program may: in generation of thecorrelation model, calculate a first weight of the correlation model ofthe first element and the second element, a second weight of thecorrelation model of the first element and a third element and a thirdweight of the correlation model of the third element and the secondelement, respectively; and in a prediction of a value of the outputelement, predict a value of the output element by comparing anaggregated weight of the second weight to the third weight and the firstweight.

Further, the program described above may be of any forms such as anobject code, a program executed by an interpreter, script data to besupplied to OS, and the like. The program can be implemented ashigh-standard procedure-type or object-oriented programming language, oras assembly or machine language according to need. In any case, thelanguage may be of a compiler type or an interpreter type. The programincorporated in application software that can be operated in an ordinalpersonal computer, a portable information terminal, or the like, is alsoincluded.

As for a method for supplying the program, it is possible to provide theprogram from external equipment communicatively coupled to a computer byan electric communication line (wired or radio line) through theelectric communication line.

For example, it is possible to provide the program by connecting to aweb page of the internet using a browser of a computer and downloadingfrom the web page the program itself or a file which is compressedincluding the automatic installation function to a recording medium suchas a hard disk.

Further, it is also possible by dividing program codes configuring theprogram into a plurality of files, and downloading each of the filesfrom different web pages.

In other words, a server which allows program files for realizingfunctional processing of the present invention on a computer to bedownloaded to a plurality of users is also included in the scope of thepresent invention.

According to a program of the present invention, it is possible toachieve the above-described apparatus according to the present inventionrelatively easily by loading the program from a storage medium such asROM that stores the control program to a computer (CPU) and having itexecuted by the computer, or by downloading the program to a computervia a communication unit and having it executed by the computer. Whenthe spirit of the present invention is embodied as software ofapparatus, the present invention naturally exists in a storage medium onwhich the software is stored and used.

There is no question that the program is all the same regardless of thereproduction stages thereof (whether the program is of a primaryrecorded program or secondarily recorded program). In case where theprogram is supplied by utilizing a communication line, the presentinvention is made use of by using the communication line as atransmission medium. Needless to say, the present invention can bespecified as an invention of a program. Furthermore, dependent claimsregarding the apparatus may be configured such that they correspond todependent claims of the method and the program.

(Information Recording Medium)

Further, the program may be recorded on an information recording medium.An application program containing the program is stored on aninformation recording medium, and it is possible for a computer to readout the application program from the information recording medium andinstall the application program to a hard disk. With this, the programcan be provided by being recorded on an information recording mediumsuch as a magnetic recording medium, an optical recording medium, a ROM,or the like. Using such program-recorded information recording medium ina computer realizes to configure a convenient information processor.

As an information recording media for supplying the program, it ispossible to use a semiconductor memory such as a ROM, a RAM, a flashmemory, or a SRAM and an integrated circuit, an USB memory or a memorycard including such, an optical disk, a magneto-optical disk, a magneticrecording medium, or the like. Further, the program may be recorded on amovable medium such as a flexible disk, a CD-ROM, a CD-R, a CD-RW, anFD, a DVD ROM, an HD DVD (HD DVD-R-SL: single layer, an HD DVD-R-DL:double layer, an HD DVD-RW-SL, an HD DVD-RW-DL, an HD DVD-RAM-SL), aDVD+/−R-SL, a DVD+/−R-DL, a DVD+/−RW-SL, a DVD+/−RW-DL, a DVD-RAM, aBlu-Ray Disk (Registered Trademark): a BD-R-SL, a BD-R-DL, a BD-RE-SL, aBD-RE-DL), an MO, a ZIP, a magnetic card, a magnetic tape, an SD card, amemory stick, a nonvolatile memory card, an IC Card, or may be recordedon a storage device such as a hard disk that is built-in on a computersystem.

Further, the information recording medium is to include a medium such asa communication line which is used when transmitting the program via thecommunication line such as a network of the Internet or a telephonecircuit or the like that kinetically holds the program for a short time(transmission medium or a carrier wave), and to include a medium thatholds the program for a specific length of time, such as a volatilememory provided inside a computer system to be a server or a client ofthe above-described case.

Furthermore, in a case where an OS operated on a computer or an RTOS orthe like on a terminal (for example, a mobile telephone) executes a partof or the whole processing, it is also possible to achieve the samefunctions and obtain the same effects as those of the exemplaryembodiments described above.

Further, it is also possible to distribute a recording medium such as aCD-ROM in which the program is coded and stored to a user; let the userwho satisfies a prescribed condition download key information fordecoding the codes from a web page via the internet; and execute thecoded program by using the key information to have the program installedto a computer. In this case, the structures of the present invention mayinclude each structural element of the program (various means, steps,and data) and a coding means for coding the program (various means,steps, and data).

Furthermore, although the system according to the exemplary embodimentshas been described as a client server system above, it may be a systemby Peer-to-Peer communication where terminals configure a network andtransmit/receive data each other without a server.

In that case, a manager may be a master terminal in a peer-to-peermethod.

Also, there is no problem to integrate a system according to theabove-described exemplary embodiments and other information processingsystems to configure the whole of the systems as a system according tothe present invention. This information processing system is to includeOS and hardware such as peripheral equipment.

A system in the exemplary embodiment refers to one in which a pluralityof apparatuses are assembled logically, and whether the apparatuses ofeach configuration are in the same chassis or not is not a question. Forthis reason, the present invention may be applied to a system includinga plurality of equipment, and it may also be applied to an apparatusincluding one device. OS and hardware such as a peripheral device may beincluded in a system

Further, as for the information processor on which the above-describedprogram and the like are loaded, a server is not limited to a personalcomputer, but various servers, EWS (engineering work station), amedium-sized computer, a mainframe, or the like may be used. In additionto the above examples, an information terminal may be so structured thatit can be utilized through a portable information terminal, variousmobile terminals, a PDA, a portable telephone, a wearable informationterminal, various kinds of (portable, for example) televisions, a DVDrecorder, various kinds of audio equipment, a household appliance towhich various information communication functions are incorporated, agame machine having a network function, etc. Alternatively, one which ismodified as an application displayed on these terminals can also beincluded in the scope of the present invention.

Further, the above-described program may be a program that achieves apart of the functions described above, or may be a so-called differencefile (difference program) which can achieve the above-describedfunctions in combination with a program that has already been stored inthe computer system.

Furthermore, the steps shown in the flowcharts of the presentspecification include not only the processing executed in a time seriesmanner according to the depicted procedures but also the processing thatis not necessarily executed in a time series manner but executed inparallel or individually. Regarding the actual implementation, the orderof the program procedures (steps) can be altered. Further, depending onneeds of an implementation, a specific procedure (step) described in thecurrent specification can be implemented, eliminated, added, orrearranged as a combined procedure (step).

Further, the functions of the program such as each means and eachfunction of the apparatus, and the functions of the procedures of eachstep may be achieved by dedicated hardware (a dedicated semiconductorcircuit, for example), and a part of the whole functions of the programmay be processed by the hardware, and the other functions may beprocessed by software. In a case of using the dedicated hardware, eachunit may be formed by an integrated circuit such as an LSI. These unitsmay be formed on a single chip individually, or a part or the entireunits may be formed on a single chip. Further, the LSI may be providedwith another functional block such as a streaming engine. Furthermore,the method for forming integrated circuit may not necessarily be limitedto an LSI, and a dedicated circuit or a general-purpose processor may beemployed. Moreover, if there is introduced a technique for achievingcircuit integration in place of a LSI due to improvements in thesemiconductor technique or other techniques derived therefrom, thattechniques can naturally be used to integrate the functional blocks.

Further, “communication” may be radio communication, wiredcommunication, or communication achieved by employing both the radiocommunication and the wired communication (i.e., communication isachieved by employing the radio communication in a certain section andby employing the wired communication in another section). In addition,“communication” may be achieved by employing the wired communicationfrom a certain device to another device and employing the radiocommunication from another device to still another device.

Further, “communication” includes a communications net. As a networkconfiguring the communications net, any of hardware structures can beemployed, e.g., various circuit nets such as a portable telephonecircuit net (including a base station and a switching system), a publictelephone circuit net, an IP telephone net, an ISDN circuit net, or anet similar to those, the Internet (i.e., a communication mode usingTCP/IP protocol), the Intranet, LAN (including Ethernet (RegisteredTrademark) and gigabit Ethernet (Registered Trademark)), WAN, an opticalfiber communications net, a power-line communications net, variousdedicated circuit net capable of handling broadband, etc. Further, thenetwork may employ any kinds of protocols, and it may be a network usingTCP/IP protocol, a network using any kinds of communication protocolsother than the TCP/IP protocol, a virtual network built in asoftware-oriented manner, or a network similar to those. Furthermore,the network is not limited only to a wired network but may also be aradio (including a satellite communication, various high-frequencycommunication means, or the like) network (for example, a networkincluding a single carrier communication system such as a handy phonesystem or a portable telephone, a spread spectrum communication systemsuch as W-CDMA or a radio LAN conforming to IEEE802.11b, a multicarriercommunication system such as IEEE802.11a or Hiper LAN/2) andcombinations of those may be used, and a system connected to anothernetwork may also be employed. Further, the network may be of any formsuch as point-to-point, point-to-multipoints,multipoints-to-multipoints, etc.

Further, in a communication structure between an operations managementapparatus and controlled units, an interface formed in one of or bothsides of them may be of any types such as a parallel interface, a USBinterface, IEEE1394, a network such as LAN or WAN, a type similar tothose, or any interface that may be developed in the future.

Furthermore, the way to generate correlation model, and to perform modelsearch does not need to be limited only to a substantial device, it iseasily understood that the present invention may function as a methodthereof. Accordingly, the present invention regarding a method is notlimited only to a substantial device but may also be effective as amethod thereof. In this case, an operations management apparatus and anoperations management system may be included as examples for realizingthe method.

Such an operations management system may be used alone or may be usedwhile being mounted to an apparatus, for example, and thus the technicalspirit of the present invention is not limited only to such cases butmay also include various forms. Therefore, the present invention may beapplied to software or hardware, and the forms thereof may change asneeded. When the technical spirit of the present invention is embodiedas software of an apparatus, the present invention naturally exists on arecording medium on which the software is recorded and is utilized.

Further, a part of the present invention may be achieved by software andthe other part thereof may be achieved by hardware, or a part thereofmay be stored on a recording medium to be read accordingly and asneeded. When the present invention is achieved by software, it may bestructured to use hardware and an operating system, or may be achievedseparately from those.

It is supposed that the scope of the invention is not limited to theexamples of illustration.

Furthermore, various stages are included in each of the above-describedexemplary embodiments, and it is possible to extract various inventionstherefrom by combining a plurality of structural elements disclosedtherein. That is, the present invention includes various combinations ofeach of the exemplary embodiments as well as combinations of any one ofthe exemplary embodiments and any one of modifications examples thereof.In such cases, operational effects obvious from each structure disclosedin each of the exemplary embodiments and the modifications examplesthereof are to be included in the operational effects of an exemplaryembodiment, even if there are no specific depictions of those in theexemplary embodiment. Inversely, all the structures that provideoperational effect depicted in the exemplary embodiments are notnecessarily the essential structural elements of the substantial featurepart of the present invention. Moreover, an exemplary embodimentconfigured by omitting some structural elements from the entirestructural elements disclosed in the exemplary embodiments, and thetechnical range based upon the structure thereof may also be taken asthe invention.

Each of the exemplary embodiments and the modification examples thereofare merely presented as examples out of variety of embodiments of thepresent invention for helping the present invention to be understoodeasily. That is, they are just showing examples when putting the presentinvention into effect, are illustrative, are not intended to limit thescope of the present invention, and various modifications and/or changescan be applied as needed. It is to be understood that the presentinvention can be embodied in various forms based upon the technicalspirit and the main features thereof, and the scope of the technicalspirit of the present invention is not to be limited by the exemplaryembodiments and the modification examples thereof.

Accordingly, it is to be understood that each of the elements disclosedabove is to include all the design changes and the equivalent thereofwithin the scope of the technical spirit of the present invention.

In an operations management apparatus of related technology, there arefollowing problems.

That is, in Japanese Patent Application Laid-Open No. 2003-131907, whenthe configuration is changed partially during continuation of practicaluse, or when biased use of services occurs, a load may concentrate on anelement which is different from ones of at the time of a test. It isdifficult to assume all of such changes beforehand, and consequently,there is a problem that an unexpected element becomes a bottleneckaccording to use conditions outside the assumption.

In Japanese Patent Application Laid-Open No. 2006-024017, when a systemis magnified or when it cooperates with other systems, a relationbetween processing and a load becomes very complicated, and consequentlyan operations management apparatus has to collect the history of allprocessing which might be related and analyze it in order to predict aload correctly.

For this reason, there is a problem that, for a correct prediction of aload, a load for a data collection and an analysis is large, and thushigh knowledge for analyzing that is needed. There is also a problemthat a correct bottleneck analysis cannot be performed, becausereliability of a load predicted only from specific processing is low.

In Japanese Patent Application Laid-Open No. 2002-268922, anadministrator has to verify whether there is a possibility that a valuepredicted from individual performance information occurs in actualoperation of the system, separately, because a performance value ofelements configuring a system does not vary completely independently.For this reason, there is a problem that, in order to determine anelement to be a bottleneck correctly, much knowledge is required for anadministrator, and the work load of the verification by theadministrator also becomes large.

In Japanese Patent Application Laid-Open No. 2002-342182, an operationsmanagement apparatus just shows a possibility of the causality byquantifying a magnitude of the relation between performance information.Accordingly, there is a problem that an administrator has to verifywhich actually is the cause like Japanese Patent Application Laid-OpenNo. 2002-268922.

Also, when a system is magnified and accordingly the number of elementsis increased, there is a problem that the load becomes enormous,because, for each one element, processing to perform multi regressionanalysis with every other elements is needed in order to quantify themagnitude of a relation between performance information.

Also, because it is difficult to calculate a value of another elementfor a value of a certain one element, there is a problem that anadministrator cannot perform an analysis such as which element will be abottleneck to a load which can occur in the future.

In Japanese Patent Application Laid-Open No. 2006-146668, a correlationcoefficient between obtained operation information is a value, and fromcorrelation of values at some point of time (the time of abnormality),the associated cause of the abnormality can be shown. However, there isa problem that an operations management apparatus cannot perform acorrect bottleneck analysis, because correlation of future values thatdo not exist can not be calculated.

In Japanese Patent Application Laid-Open No. 2007-207117, a function ofindividual performance information is presumed (like Japanese PatentApplication Laid-Open No. 2002-268922). Here, in the formula of y=f(x),x is a time and the formula expresses a time change of one y. Anoperations management apparatus prepares two such formulas, and therelation between the two is determined by a correlation rule givenseparately. Because the rule is not generated automatically, when notgiving a rule between all performance information for each element of asystem separately, there is a problem that an operations managementapparatus cannot predict a bottleneck analysis correctly.

That is, because a correlation between the CPU utilization rate and thethroughput is a correlation only between an element and another element,and as a result, not all the correlations between all elements of asystem is clear, there is a problem that it cannot predict to whichelement a bottleneck of the system most likely occur.

In Published Japanese translation of PCT application No. 2005-524886bulletin, correlation model is not used, although a conversion of aworkload and metrics is performed. Accordingly, there is a problem thatan administrator has to input everything of these conversion methods byhandwork.

Thus, in an operations management apparatus of the related technology,there is a problem that a bottleneck which may occur in an actualoperational situation cannot be predicted correctly, and consequentlyadministrator's burden and a load of analysis processing is increased.

That is, first, it is difficult to assume completely situations that canoccur in the future beforehand, and consequently, there is a problemthat an unexpected element becomes a bottleneck in use conditionsoutside the assumption.

Secondly, there is a problem that, for a correct prediction, a load ofdata collection and analysis is large and high knowledge for analyzingthat is needed. Also, there is a problem that reliability of a loadpredicted only from specific processing is low and thus a correctbottleneck analysis cannot be performed.

Thirdly, there is a problem that much knowledge is required for anadministrator in order to determine an element to be a bottleneckcorrectly, and accordingly the work load of the administrator for theverification becomes large.

Fourthly, when a system is magnified and elements are increased, thereis a problem that a load becomes enormous. Further, there is a problemthat an analysis such as which element will be a bottleneck for a loadwhich has a possibility to occur in the future cannot be performed,because it is difficult to calculate a value of another element for avalue of a certain one element.

According to the present invention, a correlation model generation unitgenerates correlation models of the overall operating state of a systemusing transform functions between elements of performance information.Also, a model searching unit predicts a value of another element (outputelement), when a value of one element (input element) of performanceinformation is supposed, by tracing transform functions in thecorrelation models in sequence.

An exemplary advantage according to the invention is that an operationsmanagement apparatus, an operations management system, a data processingmethod and an operations management program in which a bottleneck whichmay occur in an actual operational situation can be predicted correctlyby extracting and modeling a correlation between each element ofperformance information appropriately, administrator's burden is low,and a bottleneck analysis which does not increase the processing loadneeded for the analysis can be realized even in a large-scaleenvironment can be provided.

The previous description of embodiments is provided to enable a personskilled in the art to make and use the present invention. Moreover,various modifications to these embodiments will be readily apparent tothose skilled in the art, and the generic principles and specificexamples defined herein may be applied to other embodiments without theuse of inventive faculty. Therefore, the present invention is notintended to be limited to the embodiments described herein but is to beaccorded the widest scope as defined by the limitations of the claimsand equivalents.

Further, it is noted that the inventor's intent is to retain allequivalents of the claimed invention even if the claims are amendedduring prosecution.

What is claimed is:
 1. An operation management apparatus comprising: ageneration unit which generates a correlation model including aplurality of correlation functions between pieces of performanceinformation based on series of performance information each indicatingtime series variation of a piece of the performance information andweights each indicating a prediction error of the respective correlationfunctions, the pieces of performance information being acquired from oneor more devices included in a system, and performs pruning of a route ofthe correlation model based on the weight.
 2. The operations managementapparatus according to claim 1 wherein the generation unit applies avalue of one of the series of performance information to the correlationfunction to obtain a predicted value of another of the series ofperformance information, and calculates a weight of the correlationfunction based on a difference between the predicted value and a valueof the another of the series of performance information.
 3. Theoperations management apparatus according to claim 1 further comprising:a searching unit which predicts a second piece of performanceinformation by using a route having the largest weight among a pluralityof routes each including one or some of the correlation functions from afirst piece of performance information to the second piece ofperformance information in the correlation model.
 4. The operationsmanagement apparatus according to claim 1 further comprising: a totalperformance information manager which generates groups of one or morepieces of performance information and calculates a total value of thepieces of performance information included in the respective groups,wherein the generation unit generates the correlation model includingcorrelation functions between the groups.
 5. A data processing methodcomprising: generating a correlation model including a plurality ofcorrelation functions between pieces of performance information based onseries of performance information each indicating time series variationof a piece of the performance information and weights each indicating aprediction error of the respective correlation functions, the pieces ofperformance information being acquired from one or more devices includedin a system; and performing pruning of a route of the correlation modelbased on the weight.
 6. The data processing method according to claim 5,wherein the generating a correlation model applies a value of one of theseries of performance information to the correlation function to obtaina predicted value of another of the series of performance information,and calculates a weight of the correlation function based on adifference between the predicted value and a value of the another of theseries of performance information.
 7. The data processing methodaccording to claim 5 further comprising: predicting a second piece ofperformance information by using a route having the largest weight amonga plurality of routes each including one or some of the correlationfunctions from a first piece of performance information to the secondpiece of performance information in the correlation model.
 8. The dataprocessing method according to claim 5 further comprising: generatinggroups of one or more pieces of performance information and calculates atotal value of the pieces of performance information included in therespective groups, wherein the generating a correlation model generatesthe correlation model including correlation functions between thegroups.
 9. A non-transitory computer readable storage medium recordingthereon a program, the program causing a computer to perform a methodcomprising: generating a correlation model including a plurality ofcorrelation functions between pieces of performance information based onseries of performance information each indicating time series variationof a piece of the performance information and weights each indicating aprediction error of the respective correlation functions, the pieces ofperformance information being acquired from one or more devices includedin a system; and performing pruning of a route of the correlation modelbased on the weight.
 10. An operation management apparatus comprising:generation means for generating a correlation model including aplurality of correlation functions between pieces of performanceinformation based on series of performance information each indicatingtime series variation of a piece of the performance information andweights each indicating a prediction error of the respective correlationfunctions, the pieces of performance information being acquired from oneor more devices included in a system, and performing pruning of a routeof the correlation model based on the weight.